3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said. The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker's own tools and a list of

Report facts: An attacker maintained persistent remote control inside Thai broadband provider 3BB’s internal network by abusing MeshCentral, a legitimate remote management tool, and targeted subscriber credentials according to Hunt.io’s investigation of an exposed attacker-controlled server. This indicates compromise via legitimate IT tooling rather than a bespoke backdoor. RealGround analysis: While the incident is not explicitly about AI systems, it highlights supply-chain style risk where trusted administrative or management platforms become attacker footholds, a pattern that can analogously affect AI infrastructure and MLOps tooling. Organizations should treat management and orchestration tools for AI services as high-value assets, applying hardening, access control, monitoring, and SBOM-style inventory to prevent similar abuse of “legitimate” components in their AI supply chain.