# Cyberattack on Thai ISP Exploits Fortinet and F5 Vulnerabilities

*Published September 16, 2026*
*Source: [https://www.securityweek.com/thai-broadband-provider-hacked-via-fortinet-vulnerability/](https://www.securityweek.com/thai-broadband-provider-hacked-via-fortinet-vulnerability/)*

## Executive Summary

3BB, a leading Thai broadband provider, was breached through vulnerabilities in Fortinet and F5 products, allowing attackers to steal credentials and establish backdoors. This sophisticated attack underscores the need for enhanced security measures to protect critical infrastructure.

## Article

A significant cybersecurity breach has targeted 3BB, a major broadband provider in Thailand, through vulnerabilities in Fortinet and F5 products. The intrusion was identified after hackers left their tools in an unsecured directory on Thai infrastructure. This directory contained nearly 300 files that included exploitation scripts, privilege escalation tools, and a persistent backdoor agent. These tools were specifically tailored for 3BB and its previous parent company, Jasmine.

The attackers gained initial access by exploiting a FortiGate SSL-VPN endpoint. They used shell scripts to determine the firmware version and deployed exploits for vulnerabilities such as CVE-2024-21762, achieving remote code execution. Concurrently, they assessed vulnerabilities in the company's F5 BIG-IP instance and the internal sales agent portal.

Once inside, the threat actors escalated privileges on Linux systems using known exploits like PwnKit and Dirty COW. They established persistent remote access with MeshCentral, used for command and control, and moved laterally across the network. The attackers harvested credentials, extracted sensitive data, and modified database privileges to maintain access.

The operation concluded with a cleanup script intended to erase traces of their activity while ensuring continued access. This script validated the ongoing functionality of persistence mechanisms, including hidden binaries and active services, indicating a sophisticated and stealthy attack strategy.