Hunt.io discovered an open directory hosted on infrastructure in Thailand containing 298 files related to an ongoing intrusion against 3BB and a linked broadband provider. The attacker leveraged CVE-2024-21762 to remotely execute code on a FortiGate 60F SSL-VPN device. The directory contained a full operational toolkit including reconnaissance scripts, exploitation payloads, brute-force tools targeting internal IP ranges, credential harvesting scripts focused on RADIUS subscriber authentication databases, and a MeshCentral remote management agent configured for persistence. The attacker possessed valid OpenVPN certificates issued by the target's PKI and active session cookies, demonstrating successful network compromise. The staging server also functioned as a reverse shell callback host. The attacker pre-staged anti-forensic cleanup scripts but preserved the MeshCentral backdoor. Hunt.io responsibly disclosed the findings to affected organizations and CERT with TLP:AMBER.

The attacker achieved remote code execution on a FortiGate SSL-VPN device, enabling deep network access into the broadband providers' internal infrastructure. This allowed extraction of subscriber authentication credentials from RADIUS databases, potentially compromising subscriber accounts. The attacker established persistent remote access via MeshCentral agents and possessed valid VPN certificates and session cookies, indicating extensive control over the network environment. The operation included lateral movement and credential harvesting, increasing the risk of further compromise and data exfiltration. The presence of cleanup scripts suggests attempts to evade detection and forensic analysis.

Patch status for CVE-2024-21762 should be verified with Fortinet's official advisories; remediation likely involves applying vendor-provided patches or updates to FortiGate SSL-VPN devices. Organizations should audit their FortiGate SSL-VPN deployments for signs of compromise, including unauthorized MeshCentral agents and unexpected VPN certificates or session tokens. Since the attacker used a known CVE, applying the official fix is critical. Hunt.io's disclosure indicates affected parties were notified, but organizations should conduct thorough incident response and credential resets for impacted RADIUS databases. Monitoring for persistence mechanisms such as MeshCentral agents is recommended. No indication that the vulnerability is in a cloud service; remediation responsibility lies with the affected organizations.