CVE-2024-21762 FortiGate SSL-VPN Exploitation + MeshCentral RMM Persistence: Thai Telecom Intrusion — OTX Detection Pack

Threat Summary

A single but high-fidelity OTX pulse documents an active, hands-on-keyboard intrusion campaign against Triple T Broadband (3BB) — one of Thailand's largest broadband and telecommunications providers. The intrusion was exposed when researchers at Hunt.io discovered an open directory on attacker infrastructure containing operational artifacts from the campaign, effectively giving defenders a window into the adversary's toolkit and staging.

The attack chain is a pattern we have seen repeatedly across 2024–2026 edge-device exploitation waves:

1. Initial Access — Exploitation of CVE-2024-21762, a critical out-of-bounds write vulnerability (CVSS 9.6) in FortiGate SSL-VPN, against a FortiGate 60F appliance. This vulnerability has been mass-exploited by both state-nexus actors and criminal groups since its disclosure.
2. Post-Exploitation Reconnaissance — Extensive internal discovery against telecom infrastructure, including enumeration of mail, VPN, and agent-management subdomains belonging to 3BB and affiliated entities (Jasmine International).
3. Persistence & C2 — Deployment of MeshCentral, a legitimate open-source remote monitoring and management (RMM) platform, as the command-and-control and persistence layer. This is a classic living-off-trusted-tools technique: RMM traffic blends into legitimate IT administration activity and rarely triggers signature-based detection.
4. Objective — While the pulse does not confirm final objectives, the combination of telecom targeting, extensive reconnaissance, and credential-focused post-exploitation activity strongly suggests credential harvesting and pre-positioning — either for espionage, downstream access brokerage, or staging for deeper compromise of subscriber and infrastructure systems.

The adversary remains unattributed, but the tradecraft — edge-device zero/n-day exploitation followed by legitimate RMM tooling — is consistent with both APT pre-positioning activity against Southeast Asian telecoms and sophisticated initial access broker (IAB) operations.

Threat Actor / Malware Profile

Adversary: Unknown (unattributed) Vector: CVE-2024-21762 — FortiOS SSL-VPN out-of-bounds write Persistence/C2 Tooling: MeshCentral (legitimate RMM, weaponized)

Distribution Method

No phishing or payload delivery is required. Initial access is achieved purely through network-level exploitation of an internet-facing FortiGate 60F SSL-VPN interface. Post-exploitation tooling (MeshCentral agent) is pushed onto internal hosts after the perimeter is breached, typically via compromised admin credentials, WMI/SMB lateral movement, or GPO abuse.

Payload Behavior (MeshCentral Agent — meshagent.exe)

• Installs as a Windows service (commonly named Mesh Agent or a renamed variant) for SYSTEM-level persistence.
• Provides the operator with full interactive remote desktop, remote shell, file transfer, and terminal access — functionally equivalent to a fully featured RAT.
• Because MeshCentral is legitimate software with valid code-signing, it bypasses application allowlisting and most AV signatures.

C2 Communication

• MeshCentral agents establish outbound TLS connections (TCP/443) to the MeshCentral server — in a weaponized deployment, this is attacker-controlled infrastructure rather than a corporate RMM server.
• Traffic uses WebSocket-style persistent connections, appearing as ordinary HTTPS and defeating perimeter egress filtering that does not perform destination reputation analysis.
• The reconnaissance activity targeted hostnames including mail.3bb.co.th, agent.3bb.co.th, ccs.jasmine.com, and openvpn.jasmine.com — indicating mapping of VPN concentrators, mail systems, and customer-care systems as pivot or collection targets.

Persistence Mechanism

• Windows service installation by the MeshCentral agent (auto-start, SYSTEM context).
• Survival across reboots; agent self-updates from the operator's MeshCentral server.
• FortiGate-level persistence is also a risk: CVE-2024-21762 exploitation has historically been paired with firmware-level implants, rogue admin accounts, and modified SSL-VPN login pages for credential capture.

Anti-Analysis Techniques

• Use of legitimate, signed software (MeshCentral) to evade signature and reputation controls.
• No custom malware family = no hash-based IOCs to block; detection must be behavioral.
• Attacker staging hosted in an exposed directory — operational sloppiness that enabled discovery, but the intrusion tradecraft itself is disciplined.

IOC Analysis

The pulse contains 6 indicators across 2 types:

Key SOC guidance:

• The absence of malware hashes and C2 IPs is the defining feature of this intrusion class. Do not treat this pulse as a feed-ingestion exercise — treat it as a detection engineering trigger for RMM abuse and edge-device exploitation behavior.
• Ingest the hostnames into DNS query logging and passive DNS correlation. www.ayuthayatech.com is notable as a likely staging or relay asset and should be retro-hunted in proxy/DNS logs.
• Use CVE-2024-21762 as a vulnerability-priority pivot: any unpatched FortiGate in your estate should be assumed compromised until proven otherwise (this CVE has been exploited in the wild since February 2024).
• Tooling: run Fortinet's official IoC-checking script for FG-IR-24-015 against appliances; deploy Sysmon (Event IDs 1, 3, 6, 7045) on servers/workstations to capture service installation and outbound RMM connections.

Detection Engineering

---
title: MeshCentral RMM Agent Execution or Service Installation
id: 9f1a7c2e-3b6d-4e8a-a1c5-7d2f4b9e0a11
status: experimental
description: Detects execution or service installation of MeshCentral (meshagent), a legitimate RMM tool abused for C2 and persistence in the 3BB Thai telecom intrusion following CVE-2024-21762 FortiGate exploitation.
author: Security Arsenal Threat Intelligence
references:
  - https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion
date: 2026/10/14
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\meshagent.exe'
      - '\Mesh Agent.exe'
  selection_cmd:
    CommandLine|contains:
      - 'meshcentral'
      - 'meshagent'
      - '-install'
      - '-fullinstall'
  condition: selection_img or selection_cmd
falsepositives:
  - Legitimate enterprise use of MeshCentral RMM (validate against approved software inventory)
level: high
---
title: Suspicious RMM Tool Outbound Connection on TCP 443
id: 4c8d2f1a-6e9b-4a3c-b7d5-2f8e1a9c0b22
status: experimental
description: Detects MeshCentral agent establishing outbound TLS/WebSocket connections to non-corporate infrastructure, as observed for C2 in the Thai broadband intrusion campaign.
author: Security Arsenal Threat Intelligence
references:
  - https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion
date: 2026/10/14
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\meshagent.exe'
    DestinationPort: 443
    Initiated: 'true'
  filter_corporate:
    DestinationHostname|contains:
      - '.yourcompany.com'
      - '.your-rmm-domain.com'
  condition: selection and not filter_corporate
falsepositives:
  - Approved MeshCentral deployments connecting to corporate RMM server (add to filter)
level: critical
---
title: New Service Creation Following FortiGate Edge Access — RMM Persistence
id: 7b3e9a4d-1c5f-4d2a-8e6b-3a9f0c1d5e33
status: experimental
description: Detects Windows service installation (Event ID 7045) of remote access tooling on servers, a persistence technique used post-exploitation of CVE-2024-21762 FortiGate SSL-VPN appliances.
author: Security Arsenal Threat Intelligence
date: 2026/10/14
references:
  - https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.t1219
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    Service_File_Name|contains:
      - 'meshagent'
      - 'mesh'
      - 'remote'
      - 'agent'
  filter_known_good:
    Service_Name|contains:
      - 'ApprovedITAgent'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate software deployment via SCCM/Intune (correlate with change management records)
level: high

// Hunt: MeshCentral RMM abuse + recon against telecom/mail/VPN infrastructure
// Microsoft Sentinel / Defender XDR — 30-day lookback
let Lookback = 30d;
let SuspiciousHosts = dynamic(["meshcentral", "meshagent"]);
let ReconTargets = dynamic(["mail.3bb.co.th", "agent.3bb.co.th", "ccs.jasmine.com", "openvpn.jasmine.com", "www.ayuthayatech.com"]);
let ProcessHits =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName has_any (SuspiciousHosts)
       or ProcessCommandLine has_any (SuspiciousHosts)
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256;
let NetworkHits =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName has_any (SuspiciousHosts)
       or RemoteUrl has_any (ReconTargets)
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort;
let ServiceInstalls =
    DeviceEvents
    | where Timestamp > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | where AdditionalFields has_any (SuspiciousHosts)
    | project Timestamp, DeviceName, ActionType, AdditionalFields;
union ProcessHits, NetworkHits, ServiceInstalls
| sort by Timestamp desc

# Security Arsenal — MeshCentral RMM & FortiGate Post-Exploitation IOC Hunt
# Run elevated on endpoints/servers. Checks services, processes, run keys, and live connections.

Write-Host "=== MeshCentral / Rogue RMM Hunt ===" -ForegroundColor Cyan

# 1. Check installed services for MeshCentral or suspicious RMM agents
Write-Host "`n[1] Scanning services..." -ForegroundColor Yellow
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'mesh|meshagent|remote.*agent' -or
    $_.PathName -match 'meshagent|meshcentral'
} | Select-Object Name, DisplayName, State, StartMode, PathName | Format-List

# 2. Check running processes
Write-Host "[2] Scanning running processes..." -ForegroundColor Yellow
Get-Process | Where-Object { $_.ProcessName -match 'mesh|meshagent' } |
    Select-Object Id, ProcessName, Path | Format-Table -AutoSize

# 3. Check registry Run keys for RMM persistence
Write-Host "[3] Checking Run keys..." -ForegroundColor Yellow
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | Where-Object {
            $_.Name -match 'mesh|agent|remote'
        } | ForEach-Object {
            Write-Host "  SUSPICIOUS: $key -> $($_.Name)" -ForegroundColor Red
        }
    }
}

# 4. Check active outbound TCP/443 connections from suspicious processes
Write-Host "[4] Checking outbound 443 connections from RMM-like processes..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.ProcessName -match 'mesh|meshagent') {
        Write-Host "  C2 SUSPECT: $($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):443" -ForegroundColor Red
    }
}

# 5. Check for common MeshCentral install paths
Write-Host "[5] Checking filesystem artifacts..." -ForegroundColor Yellow
$paths = @(
    "$env:ProgramFiles\Mesh Agent",
    "${env:ProgramFiles(x86)}\Mesh Agent",
    "$env:ProgramData\MeshCentral"
)
foreach ($p in $paths) {
    if (Test-Path $p) { Write-Host "  FOUND: $p" -ForegroundColor Red }
}

# 6. DNS cache check for reconnaissance target hostnames
Write-Host "[6] Checking DNS cache for campaign hostnames..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object {
    $_.Entry -match '3bb\.co\.th|jasmine\.com|ayuthayatech\.com'
} | Select-Object Entry, Data | Format-Table -AutoSize

Write-Host "`n=== Hunt complete. Review any RED findings immediately. ===" -ForegroundColor Cyan

Response Priorities

Immediate (0–4 hours)

• Inventory and patch every FortiGate/FortiOS appliance against CVE-2024-21762 (Fortinet advisory FG-IR-24-015). If SSL-VPN is not required, disable it entirely — FortiGate SSL-VPN is the single most exploited enterprise edge surface of the past two years.
• Assume compromise on unpatched appliances: run Fortinet's IoC scanner, review admin accounts for unauthorized additions, and audit SSL-VPN authentication logs for anomalous session sources.
• Hunt for MeshCentral and all unauthorized RMM tools (AnyDesk, ScreenConnect, Atera, Splashtop) using the Sigma/KQL/PowerShell content above.
• Block DNS resolution and egress to www.ayuthayatech.com; retro-hunt proxy and DNS logs for historical resolution.

24 Hours

• Credential verification and rotation: this intrusion class is fundamentally about credential theft. Force password resets for all VPN-authenticated accounts, FortiGate local admin accounts, and any credentials stored or transiting the appliance. FortiGate exploits have historically been paired with login-page tampering that captures credentials in cleartext.
• Audit for rogue local admin and service accounts on the FortiGate and on any host where a MeshCentral service is discovered.
• Review authentication logs for 3BB-affiliated hostnames (mail, agent, openvpn subdomains) if you operate in the Thai telecom ecosystem — look for password spraying and session hijacking.
• Invalidate active sessions/tokens and enforce MFA re-enrollment for remote access users.

1 Week

• Segment edge appliances away from internal networks: SSL-VPN concentrators should terminate in a DMZ with strict east-west controls — a compromised FortiGate should never yield direct access to internal servers.
• Deploy RMM allowlisting: implement application control (WDAC/AppLocker) permitting only your sanctioned RMM platform; alert on any other remote access binary or service.
• Egress filtering with destination reputation: block outbound 443 to unclassified/newly-registered domains to break MeshCentral-style C2.
• Establish firmware integrity monitoring for all edge devices; schedule recurring IoC sweeps — FortiGate implants frequently survive patching.
• Subscribe to OTX pulses tagged fortigate ssl-vpn and meshcentral for ongoing campaign tracking.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub