Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according toCERT Polska's attack warning, published on September 5.

Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or attacker identity.

MikroTik's security updatelists fixed RouterOS releases. CERT says the fixes prevent the observed attacks and recommends immediate installation, followed by a check for unauthorized configuration changes.

According to thevendor's default firewall explanation, home MikroTik devices block public access to management ports while their default firewall rules remain intact.

The Hacker News checked CERT'saffected RouterOS versionsagainst MikroTik's listed fixes on September 6. Use theofficial RouterOS downloadsfor your update.

The7.23.5 regression fixaddresses an IPv6 DHCP (Dynamic Host Configuration Protocol) problem introduced in 7.23.4 while retaining the security update.

Until the update can be installed, CERT recommends turning off exposed services or restricting access to trusted management networks, particularly for SSH, WWW/WWW-SSL, and bandwidth-test.

It also advises against initiating Transport Layer Security (TLS) connections or using RouterOS's built-in SSH clients from an unpatched device. These temporary restrictions cover the broader set of vulnerabilities and do not replace the update.

MikroTik'sFlagged status guidancestates that RouterOS flags a device when startup checks detect suspicious configuration. RouterOS disables those entries and restricts certain functions.

After updating, check the logs and run /system/device-mode/print to inspect that status. Even without a warning, inspect the configuration for unknown users, scripts, and other unrecognized changes.

CERT also points to unexpected highly privileged ops accounts and account-creation logs containing ssh:-2@ as signs to investigate.

If the warning, logs, or configuration suggest compromise, CERT recommends these recovery steps. Do not clear Flagged before preserving the evidence and completing the analysis.

CERT calls the reported 2-flaw combination MikroTrick. The Hacker News compared CERT's warning and vulnerability disclosure on September 6. Neither explicitly identifies which 2 vulnerabilities form the observed chain or explains how they combine to give administrative control.

The7.25beta3 release noteshave a September 2 changelog date, while the beta and other initial fixes were announced on September 3. The Hacker News compared these release announcements with CERT’s attack timeline on September 6. Those dates do not establish whether a fix was publicly available before the attacks, so zero-day status remains unverified.

The Hacker News has contacted CERT Polska and MikroTik for comment.