MikroTik RouterOS Zero-Day Exploited in 'MikroTrick' Attack Chain
Attackers are actively exploiting a chain of vulnerabilities in MikroTik RouterOS to gain full administrative control without authentication. CERT Polska named the exploit 'MikroTrick,' combining an SSH authentication bypass and a privilege escalation flaw. Successful attacks were observed as early as September 2, 2026, before official patches were released. MikroTik has issued updates for affected versions, urging users to patch immediately and inspect devices for signs of compromise.
Key points
- CERT Polska disclosed six vulnerabilities in RouterOS, with two forming the 'MikroTrick' chain: CVE-2026-67276 (SSH auth bypass) and CVE-2026-86060 (privilege escalation).
- Exploitation began around September 2, 2026, potentially before patches were publicly available, suggesting a zero-day status.
- Attackers used IPs 82.192.72.4 and 103.102.31.18, hosting malicious files like 'ftpsrv.py' and 'launch.sh.'
- Indicators of compromise include the creation of an 'ops' account and failed login attempts with the username '-2.'
- MikroTik released fixes in versions 6.49.21, 7.23.4, 7.23.5, 7.24.2, and 7.25beta3, with 7.23.5 addressing an IPv6 DHCP regression.
Background
This incident follows a trend of exposed network devices being targeted for remote access, as seen in earlier coverage of exposed Rockwell PLCs and hotel Wi-Fi hijacks. MikroTik routers are popular for their longevity but often remain unpatched, increasing vulnerability to new exploits.
How outlets are covering it
CERT Polska emphasized the critical nature of the 'MikroTrick' chain and recommended immediate updates. Security Affairs highlighted the potential for widespread compromise, noting that devices with exposed SSH should be treated as compromised. The Hacker News focused on the technical details of the vulnerability chain and the lack of victim counts or attacker identities in CERT's initial warning. CyberSecurityNews reported on the active exploitation but provided limited technical detail.
Why it matters
The 'MikroTrick' exploit allows attackers to gain full control of internet-exposed MikroTik routers without authentication, potentially leading to network compromise, data theft, or further attacks. The zero-day nature of the exploit and the ease of exploitation highlight the risks of unpatched network devices.
What to watch
Users should immediately update their MikroTik routers to the latest patched versions and inspect devices for indicators of compromise, such as the 'ops' account or '-2' login attempts. CERT Polska recommends isolating compromised devices and restoring factory settings before rebuilding configurations.
- Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication The Hacker News
- Vulnerabilities in Mikrotik RouterOS software CERT Polska
- Your MikroTik Router May Already Be Compromised: Look for SSH User “-2” Security Affairs
- Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access CyberSecurityNews
- MikroTik RouterOS flaws put exposed routers at risk Cybernews
Want the full story? Read the original reporting
Read on The Hacker News