The intrusion was uncovered after researchers examined a server the attacker had left exposed on the internet. That server hosted the attacker's own tooling along with a list of data tied to the operation.

According to the reporting, the attacker leveraged MeshCentral to retain remote control over internal machines within the provider's environment. The same access was used to obtain root-level privileges, and the campaign appeared to focus on subscriber credentials.

Key points from the findings:

• MeshCentral, a legitimate remote management platform, was abused as the attacker's backdoor for persistent access.
• The threat actor achieved root access on compromised internal systems.
• The operation targeted subscriber credentials held by the ISP.
• Hunt.io identified the activity by examining an attacker-operated server that had been left open on the internet, which contained the attacker's tools and a list of related data.

The use of a legitimate management tool is notable because such software is often trusted inside enterprise networks and can blend in with normal administrative activity, making the intrusion harder to detect through signature-based defenses alone.

Source: The Hacker News

If your organization runs MeshCentral or similar remote management tooling, are you auditing its exposure and access logs closely enough to spot this kind of abuse?