3BB Breach: MeshCentral RMM Tool Abused as Backdoor for Root Access

Tue, 15 Sep 2026 15:32:56 +0000

Engineer — Learn: Demonstrates how a legitimate open-source RMM platform (MeshCentral) can be weaponized for persistent root-level access — worth reviewing whether MeshCentral or similar tools are present in your environment and whether their exposure is authorized.
SOC/IR — Plan: Living-off-the-land via legitimate RMM tooling is a growing evasion pattern; build or tune detections for unauthorized MeshCentral agent deployments and anomalous outbound connections to MeshCentral servers not in your approved asset inventory.
Leader — Skip

Telecom-Breach on CuraSec