[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyQTi5AZsrtk_fajSxhYJwGRvX3lRxkHjVxp4FiAtEhw":3},{"article":4,"iocs":54,"watch_terms":73,"solutions":74,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d85e2344-1f30-4f46-968e-7c2b81e8baa8","Thai Broadband Provider Hacked via Fortinet Vulnerability","thai-broadband-provider-hacked-via-fortinet-vulnerability-da214e","The hackers staged numerous scripts for reconnaissance and CVE probing, along with brute-force utilities and privilege escalation tools. The post Thai Broadband Provider Hacked via Fortinet Vulnerability appeared first on SecurityWeek.","A threat actor has breached 3BB, a major Thai broadband provider, by exploiting vulnerabilities in Fortinet and F5 products. The attackers used a variety of scripts for reconnaissance, vulnerability probing, and privilege escalation, leaving behind an extensive toolkit in an open directory. They established persistence using MeshCentral and attempted to harvest credentials and move laterally within the network.","Hackers exploit Fortinet and F5 vulnerabilities to breach Thai broadband provider 3BB.","https:\u002F\u002Fwww.securityweek.com\u002Fthai-broadband-provider-hacked-via-fortinet-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F01\u002Fbroadband-internet-wi-fi.jpeg","2026-09-15T13:33:58+00:00","2026-09-15T14:00:43.847647+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":19},"F5",{"name":23,"type":24},"FortiGate SSL-VPN","product",{"name":26,"type":24},"BIG-IP",{"name":28,"type":24},"MeshCentral",{"name":30,"type":24},"PwnKit","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,59,61,63,66,69,71],{"type":56,"value":57,"context":58},"cve","CVE-2018-13379","Probed for this Fortinet vulnerability.",{"type":56,"value":60,"context":58},"CVE-2022-42475",{"type":56,"value":62,"context":58},"CVE-2023-27997",{"type":56,"value":64,"context":65},"CVE-2024-21762","Exploited for RCE on Fortinet.",{"type":56,"value":67,"context":68},"CVE-2021-22986","Probed for this F5 BIG-IP vulnerability.",{"type":56,"value":70,"context":68},"CVE-2022-1388",{"type":56,"value":72,"context":68},"CVE-2023-46747",[18,21,23],{"controls":75,"vendors":163},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":106,"name":107,"problem":108,"products":109},"patch-management","Automated patch management","Known holes get closed in days, not months.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":135,"name":136,"problem":137,"products":138},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[164,169],{"slug":165,"name":21,"logo_path":166,"roles":167},"f5","\u002Fvendor-logos\u002Ff5.png",[168],"affected",{"slug":170,"name":18,"logo_path":171,"roles":172},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[168],{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":188},"thai-isp-breached-through-unpatched-fortinet-and-f5-vulnerabilities","Thai ISP Breached Through Unpatched Fortinet and F5 Vulnerabilities","Threat actors exploited known vulnerabilities in Fortinet and F5 network appliances to gain an initial foothold inside 3BB, a major Thai broadband provider. Once inside, attackers deployed a comprehensive toolkit for reconnaissance, credential harvesting, privilege escalation, and lateral movement — indicating a deliberate, multi-stage intrusion. The use of MeshCentral for persistence demonstrates that attackers planned for long-term access, not just opportunistic exploitation. This incident highlights the severe risk of leaving internet-facing network appliances unpatched, particularly when those devices serve as the gateway into an ISP's broader infrastructure. Unpatched edge devices in telecommunications environments can expose millions of downstream customers to risk.",[178,179,180,181,182,183,184,185,186,187],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.AM-1: Asset Inventory","NIST CSF PR.IP-12: Vulnerability Management Plan","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]