An attacker was operating inside the network of 3BB, one of Thailand’s largest broadband providers, and maintained remote control of internal machines using a legitimate management tool called MeshCentral, threat intelligence firm Hunt.io said.

The company uncovered the intrusion by examining a server the attacker had left open on the internet, which held the attacker’s own tools and a list of