#cve202421762 — Public Fediverse posts

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

Pulse ID: 6aa84f430eb4651668636168
Pulse Link: https://otx.alienvault.com/pulse/6aa84f430eb4651668636168
Pulse Author: AlienVault
Created: 2026-09-14 19:47:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SSL #VPN #CVE202421762 #CredentialHarvesting #OTX #AlienVault

Threat Actor Allegedly Selling Fortinet Firewall Zero-Day Exploit https://www.securityweek.com/threat-actor-allegedly-selling-fortinet-firewall-zero-day-exploit/ #Malware&Threats #Vulnerabilities #CVE202242475 #CVE202327997 #CVE202421762 #ThreatMon #Fortinet #FortiOS

Threat Actor Allegedly Selling Fortinet Firewall Zero-Day Exploit https://www.securityweek.com/threat-actor-allegedly-selling-fortinet-firewall-zero-day-exploit/ #Malware&Threats #Vulnerabilities #CVE202242475 #CVE202327997 #CVE202421762 #ThreatMon #Fortinet #FortiOS

Fortinet SSL VPN Exploit Up for Sale on Dark Web https://thecyberexpress.com/cve-2024-21762-exploit-sale/ #CVE202421762ExploitSale #remotecodeexecution #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202421762 #FortiProxy #FortiOS #SSLVPN