Attackers Target MikroTik Router Infrastructure
Attackers are actively hijacking MikroTik routers by exploiting the Secure Shell (SSH) remote-access service. These devices remain accessible from the open internet, allowing threat actors to gain full administrative control without any authentication. CERT Polska issued a formal warning on September 5, 2026, noting that the observed attacks began as early as September 2. There is currently no confirmed victim count or specific attribution for the attackers behind this campaign.
While the vendor’s default firewall settings are intended to block public access to management ports, many units remain exposed. MikroTik has published a list of fixed RouterOS releases to address the vulnerability, which they categorize as a significant security risk. Owners must verify if their firmware version falls within the vulnerable ranges reported by CERT, which span both 6.0.0 and 7.0.0 branches of the RouterOS software.
Remediation and Recovery Procedures
Immediate installation of the latest patches is the primary defense against this threat. Users should download the firmware directly from the official MikroTik website. For those who cannot patch immediately, CERT recommends turning off exposed services, particularly SSH, WWW/WWW-SSL, and bandwidth-test functions. Access should be restricted strictly to trusted management networks to mitigate the risk of unauthorized entry.
Post-update security checks are vital. RouterOS includes a device mode feature that flags hardware if startup checks detect configuration tampering. Administrators should execute the command /system/device-mode/print to inspect status. They must also audit logs for suspicious account-creation activity, such as entries containing "ssh:-2@". These markers suggest the presence of a compromised or backdoored administrative account.
Incident Handling and Forensic Preservation
If a device shows signs of compromise, the recovery process requires extreme care. CERT Polska advises against a simple factory reset, as it may destroy forensic evidence needed for an internal investigation. Instead, technicians should first isolate the affected router from the production network. Once isolated, the current configuration and logs should be exported and saved for analysis according to the official preservation guidelines.
After securing the data, a complete factory reset is necessary. Administrators must rebuild the system using verified, trusted configurations rather than relying on full backups created while the device was potentially vulnerable. Password rotations for all keys and secrets are mandatory after a full rebuild. MikroTik continues to monitor the impact of this incident, which researchers at CERT refer to as "MikroTrick" due to the specific chain of flaws utilized to bypass authentication. Future updates to the RouterOS development channel may provide additional hardening against similar brute-force or injection-based techniques.