3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

This is a classic supply chain pivot using a legitimate tool for persistence. The attacker didn't break in with a zero-day; they abused a trusted admin utility to blend in.

Technical Breakdown:

• Initial Access: Likely via compromised credentials or an exposed RDP/SSH service. The attacker then deployed MeshCentral, an open-source remote management tool, as a persistent backdoor.
• Persistence & C2: MeshCentral was configured to give the attacker remote shell and file access. This is a textbook "living off the land" (LotL) technique, bypassing traditional EDR that whitelists admin tools.
• Target: The attacker was specifically hunting subscriber credentials (likely PPPoE usernames/passwords or router admin creds) stored on internal systems.
• Critical Intel: Hunt.io found the attacker's own C2 server left exposed on the internet. This is a goldmine for threat intel—it likely contains the attacker's tooling, logs, and possibly other victim lists.
• IOCs: None publicly shared yet, but the exposed server is the primary IOC. Monitor for unexpected MeshCentral instances on your network (default port 443, but often custom).

Defense:

• Audit your remote management tools. If you have MeshCentral, AnyDesk, or TeamViewer deployed, verify the install was authorized and is not an orphaned instance.
• Network segmentation. Subscriber credential databases should never be accessible from a general-purpose admin jump box.
• Log monitoring. Look for MeshCentral service installations (event ID 7045) or outbound connections to unknown IPs on port 443 from internal servers.

Source: https://thehackernews.com/2026/09/3bb-attacker-used-meshcentral-backdoor.html