What happened

Heads up: attackers have been taking over MikroTik routers that have their internet-exposed SSH service reachable from the public web. According to a warning from CERT Polska, successful compromises were seen in early September. The scary bit: attackers were able to gain full administrator control without any authentication in the observed cases.

Vendor updates were released to fix the issue and related fixes have been rolled into subsequent RouterOS builds. The advisory labels the exploit chain as a two-flaw combo sometimes called “MikroTrick,” though the public write-ups haven’t spelled out exactly which two bugs combine to allow the takeover. Whether this was a zero-day at time of exploitation is not definitively confirmed.

Also worth noting: many consumer MikroTik devices block remote management ports by default when the original firewall rules are intact. If you or someone else changed those settings, your device might be exposed.

What to do right now (quick and nerdy steps)

If you run a MikroTik box, treat this like a leaking pipe in your network closet: fix the source fast and keep what’s important safe. Below are practical steps CERT Polska recommends plus a tidy recovery checklist.

  • Install updates: Apply the vendor’s RouterOS fixes immediately using official downloads. Patching is the real meal, not the garnish.
  • Temporarily turn off or restrict management services that are reachable from the internet — especially SSH, WWW/WWW-SSL and bandwidth-test. Limit access to trusted management networks only.
  • Don’t initiate TLS connections or use RouterOS’s built-in SSH clients from an unpatched device — that can widen the blast radius.
  • Check Device Mode / Flagged status: RouterOS flags suspicious configurations on startup and disables risky entries. After updating, run the device-mode check and review any flagged items.
  • Audit logs and config: look for unknown users, unexpected scripts, strange account-creation entries (CERT points to logs containing “ssh:-2@” as suspicious), and highly privileged accounts you don’t recognize.

If you find signs of compromise, treat the router like contaminated gear:

  • Isolate router: Disconnect it from the network and preserve logs and configuration files before making changes.
  • Export and download logs/config for analysis — don’t wipe evidence first.
  • Factory-reset the device and rebuild the configuration from a trusted source. Do not blindly restore a full backup from a device that might be compromised.
  • Rotate all secrets: change passwords, revoke and replace keys, and refresh any certificates or credentials used by the device.

Short version: patch ASAP, close off remote management until you’re patched, check for odd accounts or scripts, and isolate + rebuild if you suspect a takeover. If you’re responsible for a fleet, treat this as a priority incident and follow your incident-response flow.