Publication Date: September 9, 2026
Source Analysis: CERT Polska | Cloud Security Alliance | Security Affairs
|---|Author: DigitalSpying Security Team
Executive Summary
A critical exploit chain dubbed MikroTrick, targeting MikroTik network routers running RouterOS, is being actively weaponized in the wild to compromise internet-exposed routing devices without requiring valid credentials. First alerted by national cybersecurity response team CERT Polska and coordinated with global threat researchers, the attack chain links two severe zero-day vulnerabilities in RouterOS's SSH service: CVE-2026-67276 (an SSH authentication bypass) and CVE-2026-86060 (a local privilege escalation via command-line argument injection).
Telemetry indicates that threat actors launched automated scanning and exploitation campaigns starting by at least September 2, 2026—prior to vendor disclosure. Compromised routers are silently backdoored with rogue administrative SSH accounts (notably a persistent user designated as "-2"), recruited into distributed residential proxy networks, and repurposed to sniff network traffic or stage lateral intrusions into private internal subnets. MikroTik has released emergency firmware updates across all RouterOS channels to patch the vulnerabilities.
Deep-Dive Technical Analysis
1. The "MikroTrick" Exploit Chain Mechanics
The attack achieves full administrative takeover by chaining cryptographic validation failures with terminal argument parsing bugs:
* Step 1: Cryptographic Authentication Bypass (CVE-2026-67276, CVSS 9.2):
RouterOS’s custom SSH server daemon performs flawed public-key validation during the SSH handshake. Rather than validating the cryptographic signature generated by the connecting client against the complete RSA public key, the daemon validates only the key type and the mathematical modulus of the public key stored in the router’s authorized keys cache. An attacker who determines or queries an authorized user's RSA public modulus can forge a mathematically valid key token without possessing the corresponding private key. This allows the attacker to complete the SSH authentication handshake and establish a pre-authenticated session state.
* Step 2: Argument Injection Privilege Escalation (CVE-2026-86060, CVSS 9.2):
Once in this pre-authenticated state, the attacker transmits a specially crafted username string containing formatted command delimiters. When RouterOS's internal SSH login helper daemon passes this username to internal binary subroutines, it misinterprets the username as command-line arguments. This argument injection primitive allows the attacker to escape restricted shell constraints and execute arbitrary administrative commands directly in the root context.
2. Indicators of Compromise (IoCs) and Backdoor Staging
* Rogue User Account "-2": Attackers consistently execute a command sequence creating an unauthorized administrative user with the unique name "-2". This special character naming convention was chosen to complicate deletion via standard command-line syntax.
* SOCKS5 Proxy and Tunneling Activation: The exploit script automatically enables RouterOS's built-in SOCKS proxy service on non-standard ports (e.g., TCP 1080 or 8080) and creates persistent WireGuard or L2TP/IPsec tunnels back to threat-actor infrastructure.
* DNS and Traffic Redirection: In observed incidents, compromised routers had their upstream DNS resolvers altered to malicious nameservers, enabling man-in-the-middle (MitM) credential harvesting and banking trojan injection against connected local clients.
Industry Impact and Recommendations/Mitigations
Strategic Implications
* Perimeter Edge Compromise: Edge routers sit in a unique position of trust, bridging untrusted public networks with internal corporate and operational technology (OT) assets. Compromising the perimeter router allows attackers to bypass corporate firewalls, eavesdrop on unencrypted traffic, and access internal management interfaces without triggering internal network alarms.
* Pre-Disclosure Exploitation Window: Because threat actors began active exploitation days before patches were published, organizations cannot assume that applying current updates guarantees a clean state. All internet-exposed routers must be actively investigated for evidence of prior tampering.
Actionable Defensive Countermeasures
1. Update RouterOS Firmware Immediately: Apply the latest security releases:
* RouterOS v7: Upgrade to version 7.23.4, 7.24.2, or later.
* RouterOS v6: Upgrade to version 6.49.21 or later.
2. Audit Router Users and Groups: Connect via Winbox or local console and inspect /user print. Search for and remove unauthorized users, specifically any user named "-2", admin2, or unfamiliar accounts with write or full policies.
3. Disable Exposed Management Services: Disable the SSH and Winbox services on public-facing interfaces (/ip service disable ssh, /ip service disable winbox). If remote access is necessary, restrict access strictly to trusted administrative IP addresses via firewall filters (/ip firewall filter).
4. Audit Proxy and Tunnel Configurations: Check /ip socks print to ensure unauthorized proxy servers have not been enabled. Inspect /interface wireguard and /interface l2tp-client for unrecognized tunnels.
5. Reboot and Re-key Devices: Following update installation and configuration cleanup, reboot routers and rotate all administrator passwords, SSH keys, and wireless pre-shared keys.