The attack on 3BB involved extensive use of multiple known vulnerabilities across Fortinet and F5 products, including CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, CVE-2024-21762 (Fortinet), and CVE-2021-22986, CVE-2022-1388, CVE-2023-46747 (F5). Initial access was achieved by fingerprinting the FortiGate SSL-VPN firmware and exploiting CVE-2024-21762 for remote code execution. Post-compromise activities included privilege escalation via PwnKit and Dirty COW exploits, deployment of a MeshCentral agent as a persistent backdoor, lateral movement using credential harvesting and web shells, and removal of exploitation artifacts to evade detection. The attackers targeted sensitive credentials and configurations to maintain control and expand access within the network.

The compromise allowed attackers to gain remote code execution on critical network appliances, escalate privileges on multiple Linux systems, establish persistent backdoors, and move laterally within the internal network. This potentially exposed sensitive credentials, internal configurations, and databases, threatening the confidentiality, integrity, and availability of 3BB's broadband infrastructure and customer data. The use of multiple exploits and persistence mechanisms indicates a sophisticated and targeted intrusion with potential long-term access.

Patch status is not yet confirmed — check the vendor advisories for Fortinet and F5 products for current remediation guidance. Organizations should verify that FortiGate SSL-VPN and F5 BIG-IP instances are updated to firmware versions that address the referenced CVEs, including CVE-2024-21762 and others. Since this attack involved multiple vulnerabilities and post-exploitation tools, comprehensive incident response and forensic analysis are recommended to identify and remove any persistent backdoors such as MeshCentral agents and unauthorized SUID binaries. Monitor vendor advisories for official patches and apply them promptly.