Attackers Hijack MikroTik

Overview

CERT Polska has issued a warning that attackers are exploiting MikroTik routers with internet‑exposed SSH services to gain full administrative control without authentication. The attacks, observed since September 2, 2026, highlight the risks of leaving management ports exposed online without proper patching or firewall protections.

Vulnerability Details

• Attack vector: Exploitation of SSH remote‑access service exposed to the internet.
• Impact: Full administrative control without authentication.
• Affected versions:
  • RouterOS 6.0.0 → below 6.49.21 (fixed in 6.49.21).
  • RouterOS 7.0.0 → below 7.23.4 (fixed in 7.23.4; regression fix in 7.23.5).
  • RouterOS 7.24 → below 7.24.2 (fixed in 7.24.2).
  • Development channel → fixed in 7.25beta3.
• Vendor guidance: Use official RouterOS downloads for updates.

Mitigation Guidance

CERT Polska recommends:

• Update immediately to patched RouterOS releases.
• Disable exposed services or restrict access to trusted management networks.
• Avoid TLS/SSH from unpatched devices until updates are applied.
• Check flagged status using /system/device-mode/print.
• Inspect configurations for unknown users, scripts, or suspicious logs.

Signs of Compromise

• Unexpected highly privileged ops accounts.
• Account‑creation logs containing ssh:-2@.
• Suspicious configuration changes or unrecognized scripts.

If compromise is suspected:

• Isolate the router from the network.
• Preserve logs before resetting.
• Restore factory settings with a trusted configuration.
• Change passwords and keys immediately.

Attack Chain Context

CERT refers to the observed exploitation as MikroTrick, a two‑flaw combination enabling administrative control. While the exact vulnerabilities remain undisclosed, the timeline suggests attackers may have acted before fixes were publicly available, leaving the zero‑day status unverified.

Expert in the Cloud Insight

This incident underscores the critical importance of patch discipline and firewall hygiene. Exposed management ports are a direct path to compromise, and attackers are increasingly targeting network infrastructure devices as entry points. The lesson is clear: secure router management interfaces, patch promptly, and monitor for unauthorized changes to prevent attackers from hijacking control of your network.