Attackers are actively exploiting MikroTik routers with internet-exposed SSH services to gain full administrative control without authentication. CERT Polska issued a warning on September 5 about these attacks, with successful compromises dating back to at least September 2. The attackers are leveraging the SSH remote-access service being publicly reachable to bypass authentication entirely. No victim count or further technical details were disclosed in the initial warning. The campaign represents a significant threat to network infrastructure given MikroTik's widespread deployment in enterprise and ISP environments. The ability to gain full administrative control without credentials makes this a critical severity issue.
Attackers are exploiting a 2-vulnerability chain (dubbed 'MikroTrick' by CERT Polska) in MikroTik RouterOS to gain full administrative control without authentication via the SSH remote-access service exposed to the internet. The exact two vulnerabilities forming the chain are not publicly disclosed in detail. Successful attacks were observed from at least September 2, 2026. The attack vector requires the SSH management port to be internet-accessible; devices with default firewall rules intact (blocking public access to management ports) are less exposed. The 7.25beta3 fix was dated September 2 and announced September 3, making zero-day status unverified. Post-compromise indicators include unexpected highly privileged 'ops' accounts and account-creation log entries containing 'ssh:-2@'.
1. Immediately update RouterOS to the fixed versions: 6.49.21 (RouterOS 6), 7.23.5 (long-term channel), 7.24.2 (stable channel), or 7.25beta3 (development channel). 2. Until the update is installed, disable internet-exposed management services or restrict access to trusted networks, particularly SSH, WWW/WWW-SSL, and bandwidth-test. 3. Do not initiate TLS connections or use RouterOS's built-in SSH client from an unpatched device. 4. After updating, review logs and run '/system/device-mode/print' to check for Flagged status. 5. Inspect configuration for unknown users, scripts, unexpected 'ops' accounts, and log entries with 'ssh:-2@'. 6. If compromise is suspected: isolate the router, preserve logs and configuration before resetting (do not blindly restore a full backup), restore factory settings and rebuild from a trusted configuration, and change all passwords, keys, and secrets.
Unexpected highly privileged 'ops' accounts on RouterOS, Account-creation log entries containing 'ssh:-2@', RouterOS device-mode flagged status (detectable via /system/device-mode/print), Unknown users, scripts, or unrecognized configuration changes in RouterOS
