3BB Hacked via Fortinet Vulnerability, Attackers Leave Arsenal Exposed

3BB: 3BB, operating as Triple T Broadband, is a leading provider of fixed-line broadband services in Thailand. The company serves as the primary victim in a recent intrusion where threat actors exploited multiple Fortinet and F5 vulnerabilities to access its systems. Hunt.io's analysis of the attack specifically targeted tools and reconnaissance tailored to 3BB's infrastructure. Hunt.io: Hunt.io is a cybersecurity firm focused on threat intelligence, infrastructure analysis, and exposing attacker tooling through open directories and network observations. It published the detailed September 2026 report uncovering the 3BB intrusion staging environment and the specific exploitation scripts used. The firm regularly discloses findings from captured attack artifacts to affected parties and the security community. Jasmine: Jasmine International is a Thai telecommunications and media holding company that previously owned Triple T Broadband, the operator behind 3BB. Following the divestment of its broadband business, Jasmine has redirected its focus to media, content delivery, and technology solutions segments. The breach report references its prior ownership connection to the targeted provider. Threat Discovery: Publicly exposed attacker staging directories on compromised or controlled servers frequently reveal detailed operational toolkits, target inventories, and cleanup routines used in sophisticated intrusions. Persistence Methods: Attackers are deploying legitimate remote administration platforms such as MeshCentral to maintain persistent command-and-control access following successful network compromise. Vulnerability Exploitation: Threat actors continue to actively exploit known remote code execution flaws in Fortinet FortiGate SSL-VPN appliances, including CVE-2024-21762, for initial access to enterprise and infrastructure targets.