Executive Summary
Security researchers have uncovered an ongoing, large-scale exploitation campaign actively targeting MikroTik RouterOS devices exposed directly to the public internet via administrative Secure Shell (SSH) ports. Operating since at least September 2, 2026, the threat actors have compromised tens of thousands of edge networking appliances. The attackers systematically harvest administrative credentials, deploy malicious scripts, and repurpose hijacked routers into an expansive, distributed residential proxy network and DDoS botnet infrastructure.
Deep-Dive Technical Analysis
The threat actors are scanning the IPv4 address space for open TCP port 22 and administrative interfaces associated with MikroTik RouterOS hardware. The intrusion campaign leverages a combination of automated distributed credential spraying, brute-forcing weak or default administrative credentials (admin with empty or common passwords), and exploiting known unpatched RouterOS firmware vulnerabilities to achieve remote access.
Once authenticated to the router via SSH, the attackers execute a multi-stage post-compromise routine:
* Backdoor User Creation: A secondary administrative account with full read/write privileges is created under generic service names (such as system_daemon or network_sync) to maintain persistent access even if primary credentials are reset.
* SOCKS5 Proxy Injection: The actors modify the internal RouterOS configuration to enable a hidden SOCKS5 proxy server. This traffic is routed through custom firewall filter rules that bypass default network logging.
* DNS and Traffic Redirection: In targeted enterprise environments, DNS settings in RouterOS are poisoned to intercept network requests and redirect corporate users to phishing portals or credential harvesters.
* Firmware Lockdown: In several documented cases, the threat actors altered the router's update URLs or firewall rules to block the device from reaching official MikroTik update servers, preventing administrators from easily applying security patches over-the-air.
Industry Impact
MikroTik devices serve as the core network backbone for small-to-medium businesses (SMBs), remote branch offices, and internet service providers (ISPs) worldwide. By weaponizing these edge appliances into commercial proxy botnets, threat actors can route fraudulent financial activity, credential stuffing, and nation-state reconnaissance through clean, legitimate residential and business IP blocks, evading IP-reputation-based firewall filtering across global enterprise perimeters.
Recommendations and Mitigations
1. Disable Public SSH and Administrative Interfaces: Restrict SSH (port 22), WinBox (port 8291), and HTTP/HTTPS administrative access strictly to internal management subnets or behind a dedicated VPN. Never expose management ports directly to the public internet.
2. Enforce Strong Credentials and Public-Key Authentication: Immediately change all default and legacy administrative passwords to high-entropy passphrases, and mandate SSH public-key authentication while disabling password-based SSH logins.
3. Audit RouterOS User Accounts and Scheduled Scripts: Conduct an immediate audit of /user print and /system script print across all MikroTik deployments to identify and remove unauthorized accounts, backdoors, or scheduled tasks.
4. Upgrade to Latest RouterOS Stable/Long-Term Release: Ensure all devices are running the latest patched release of RouterOS, and verify that update servers resolve to official MikroTik domains.