Critical FortiGate SSL-VPN Vulnerability Exploited in Attacks on Broadband Provider

Key Takeaways

• A critical FortiGate SSL-VPN vulnerability (CVE-2024-21762) has been actively exploited in a targeted attack against Triple T Broadband, operating under the 3BB consumer brand in Thailand.
• Attackers gained persistent access, escalated privileges, and moved laterally within the broadband provider’s network, deploying tools for reconnaissance, credential theft, and remote management.
• Evidence of the extensive intrusion was discovered on an exposed attacker-controlled staging server, revealing detailed operational tactics and targeted infrastructure.
• The vulnerability, rated 9.8 CVSS, affects multiple FortiOS and FortiProxy versions, with patches available and immediate mitigation advised for unpatched systems.

Cybersecurity researchers have uncovered compelling evidence of a sophisticated intrusion campaign targeting Triple T Broadband, a major Thai internet service provider operating as 3BB. The attackers leveraged a critical FortiGate SSL-VPN vulnerability to establish a foothold, subsequently escalating privileges, stealing credentials, performing internal reconnaissance, and maintaining persistent remote access to the victim’s network.

The detailed insights into the attack were gleaned from an exposed attacker-controlled staging server, which contained a comprehensive toolkit and artifacts directly referencing 3BB infrastructure. This discovery offers an unusually clear view into the adversary’s tactics, techniques, and procedures (TTPs).

FortiGate SSL-VPN Vulnerability Exploited

The investigation by Hunt.io began on June 3, 2026, when an open directory was identified on a server at 92.63.180[.]133:8888, hosted on Bangmod Enterprise infrastructure. This server contained 298 files across 30 subdirectories, totaling 19 MB of data, which laid bare the attacker’s operational setup.

The recovered files offered a deep dive into the campaign, including FortiGate exploitation scripts, Linux privilege-escalation tools, SSH brute-force utilities, database credential harvesters, VPN configuration files, captured session cookies, cleanup scripts, and a live MeshCentral agent configuration.

Crucially, multiple artifacts directly referenced 3BB’s internal infrastructure, including 10.11.x.x IP addresses, systems under the triplet.co.th domain, and specific organizational credentials. A captured network configuration file indicated that at least some malicious tools were executed from within the broadband provider’s network, not solely from the external staging server.

The initial point of compromise appears to be a FortiGate 60F SSL-VPN appliance, exposed via mail.3bb.co[.]th:10443. Reconnaissance scripts probed the VPN service, examining HTTP headers and FortiGate resources, and testing various historical vulnerabilities before the attackers focused on CVE-2024-21762.

CVE-2024-21762 is a severe out-of-bounds write vulnerability affecting the FortiOS and FortiProxy SSL-VPN components. It allows an unauthenticated remote attacker to execute arbitrary code or commands by sending specially crafted HTTP requests, earning a critical CVSS score of 9.8. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities catalog in February 2024, confirming its active exploitation in the wild.

According to the recovered scripts, the attackers first used controlled crashes and malformed chunked HTTP requests to determine the appliance’s vulnerability. The final exploit reportedly combined heap spraying with a return-oriented programming (ROP) chain to establish a reverse shell connection to 92.63.180[.]133:9443, the same server hosting the discovered toolkit.

Further demonstrating their technical sophistication, the threat actor attempted to obtain FortiOS 7.2.5 firmware for the FortiGate 60F, likely to identify model and version-specific ROP gadgets. One script embedded the appliance’s serial number in a request designed to impersonate the device when communicating with Fortinet’s distribution infrastructure.

Post-Exploitation Activity and Persistence

After gaining initial access, the attackers deployed MeshCentral, a legitimate open-source platform for remote desktop, terminal, and file management, as a persistent backdoor. The recovered meshagent.msh configuration assigned compromised machines to a device group named “TH-3BB” and directed agents to www.ayuthayatech[.]com over port 443. A devices.json export listed multiple enrolled systems as connected, with several agents running with root privileges, indicating active administrative control at the time of export.

Persistence scripts automated MeshCentral installation, verified outbound connectivity, and checked for endpoint security products before deployment. Significantly, the attacker’s cleanup_target.sh script meticulously deleted exploitation files, web shells, authentication logs, system logs, and shell histories, while intentionally preserving the MeshCentral service to maintain access.

The operation extended beyond the initial FortiGate compromise. Eleven reconnaissance scripts targeted agent.3bb.co[.]th, a CodeIgniter-based sales portal protected by an F5 BIG-IP appliance. These scripts probed for authentication bypasses, session forgery, file uploads, SQL injection, path traversal, server-side request forgery, and HTTP request smuggling vulnerabilities.

For compromised Linux servers, the attackers prepared several privilege-escalation options, including exploits for Dirty COW and PwnKit, alongside code for installing a concealed SUID backdoor. Another tool targeted an internal Pentaho server using the Ghostcat vulnerability, and a captured output file reportedly documented root-level command execution on a Linux application server.

Credential-harvesting scripts systematically searched systems for SSH private keys, PHP configuration files, database passwords, SNMP community strings, and command histories. Other scripts targeted the radius_corp, radiusinfo, and job_radius databases, potentially exposing sensitive subscriber authentication records and network access server information.

More than 55 internal IP addresses were included in SSH password-spraying scripts, which contained both common passwords and organization-specific combinations. The presence of 3BB-related credentials suggests prior knowledge of the environment, although the method of obtaining this information remains unconfirmed.

Researchers also discovered jasmine.ovpn, an OpenVPN profile containing a certificate and private key issued under Triple T Broadband’s public key infrastructure. If still valid, this credential could potentially provide access to infrastructure associated with the Jasmine network, underscoring the critical importance of revoking exposed certificates rather than relying solely on password resets.

What You Should Do

• Patch Immediately: Fortinet identifies FortiOS versions 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, and several other releases as vulnerable to CVE-2024-21762. Administrators must upgrade to a supported fixed release without delay.
• Disable SSL-VPN if Unpatched: If immediate patching is not feasible, Fortinet recommends disabling the SSL-VPN component entirely. Disabling web mode alone is not a sufficient workaround.
• Investigate for Compromise: Organizations should proactively look for unexpected MeshCentral agents, connections to www.ayuthayatech[.]com, reverse-shell traffic involving 92.63.180[.]133, hidden SUID files, web shells, modified SSH authorization files, and unexplained gaps in security logs.
• Rotate Critical Credentials: Immediately rotate all VPN certificates, RADIUS secrets, database credentials, SSH keys, application secrets, and privileged passwords.
• Preserve Forensic Evidence: Given the attacker’s use of anti-forensic techniques (e.g., cleanup scripts), it is crucial to preserve all available forensic evidence before remediation efforts begin.
• Review Network Segmentation and Access Controls: Enhance network segmentation to limit lateral movement and review all access controls, especially for critical infrastructure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.