Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

Hunt.io discovered an exposed open directory (92.63.180.133:8888) containing 298 files that reveal an active intrusion against Thai ISP infrastructure: the attacker exploited a FortiGate SSL‑VPN RCE (CVE‑2024‑21762) to establish a reverse shell, deployed MeshCentral agents (C2 at www.ayuthayatech.com) for persistent access, harvested RADIUS and VPN credentials (including a valid jasmine.ovpn client certificate), performed internal reconnaissance and privilege escalation, and staged cleanup scripts to remove logs while preserving persistence; the report includes detailed IOCs and remediation guidance.