MikroTik SSH Attacks Raise Router Security Stakes

Attackers have been seizing control of MikroTik routers whose SSH service is exposed to the internet, breaking in without needing any credentials. The campaign, detailed in an alert from CERT Polska, has been active since at least September 2, and the Polish incident response team is urging administrators to patch immediately. The attacks carry an outsized danger because they strike the very devices that guard network boundaries, and the full scope of the compromise may not be immediately obvious.

How the Attack Works

CERT Polska’s advisory, issued September 5, describes how the attackers target RouterOS devices with SSH reachable from the internet, and manage to gain full administrative control without authentication. The alert does not name the specific vulnerabilities involved, nor does it pin down the number of victims or the identity of the attackers, according to The Hacker News’ review of the advisory on September 6.

This style of intrusion is especially worrying because many network administrators rely on SSH for remote management, and a compromise can lead to deep network persistence. MikroTik routers are widely used in small and medium businesses, and administrators may not have patched because they assume management interfaces are protected by default.

CERT Polska’s Warning

The advisory from CERT Polska, which coordinates incident response for Poland’s networks, calls the attack chain “MikroTrick.” While the name is catchy, the advisory itself does not detail which two flaws combine, nor the precise mechanics, leaving gaps in the public understanding of the attack.

MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, are being exploited... to gain full administrative control without authentication.

— CERT Polska, in its September 5 advisory

The warning is significant because it comes from a national CSIRT, indicating real-world exploitation rather than theoretical risk. CERT Polska’s role adds weight to the urgency for MikroTik users to respond.

Patches Available for All Editions

MikroTik has released fixes across its software lines to counter the threat. The updates are listed in MikroTik’s security bulletin, and CERT recommends installing them without delay. The affected range starts at RouterOS 6.0.0, through the 6.x series, the 7.x series, and also includes the 7.24.x line, with specific fixed versions assigned.

• RouterOS 6.49.21 is the fix for versions from 6.0.0 up to 6.49.21 (6.x security release)
• RouterOS 7.23.4 is the initial fix for versions from 7.0.0 up to 7.23.4, with 7.23.5 recommended on the long-term channel
• RouterOS 7.24.2 fixes versions from 7.24 up to 7.24.2 (stable channel security release)
• No development range was listed in CERT’s disclosure, but 7.25beta3 is the development channel fix

According to CERT, these patches stop the observed attacks. The notice also points out that version 7.23.5, in addition to addressing the security flaw, fixes an IPv6 DHCP (Dynamic Host Configuration Protocol) regression introduced in 7.23.4, so long-term users have a reason to move to that release.

Temporary Mitigations

For environments where an immediate patch is not possible, CERT Polska outlines interim steps to reduce exposure. The team advises turning off exposed administration services or limiting them to trusted management networks, calling out SSH, WWW/WWW-SSL, and bandwidth-test as particular ports to restrict.

The advisory also tells administrators to avoid initiating Transport Layer Security (TLS) connections or using RouterOS’s built-in SSH clients from an unpatched device. These are not permanent substitutes for the update, CERT warns, but they can blunt the attack surface for the wider set of vulnerabilities.

MikroTik’s default firewall configuration, as explained by the vendor, is meant to block public access to management ports on home devices as long as those default rules have not been changed. That suggests many compromised routers may have been reconfigured or are in environments where the defaults were not applied, though the advisory does not speculate.

What to Check After Patching

Once a patch is installed, CERT Polska says the work is not over. Administrators should inspect the router’s log for warning flags and run the command /system/device-mode/print to check the device’s status. RouterOS has a “Flagged” mechanism that triggers when startup checks detect suspicious configuration, and in those cases the system disables the questionable entries and restricts certain functions.

The advisory also points to specific signs that could indicate a breach: unexpected highly privileged “ops” accounts, and account-creation logs containing “ssh:-2@” entries. Even if no warning is visible, CERT advises reviewing the configuration for unknown users, scripts, or other unrecognized changes.

Recovery Steps for Compromised Devices

If the logs or configuration point to a compromise, CERT Polska lays out a clear recovery path. The first step is to isolate the router from the network and preserve its logs and configuration before resetting it — a crucial step that ensures evidence is not lost. CERT has published a preservation guide in Polish that explains how to export and download those files.

Afterward, administrators should restore the router to its factory settings and rebuild it using a trusted, verified configuration. CERT explicitly cautions against restoring a full backup taken from the potentially compromised device, since that could reintroduce the attacker’s changes. Finally, it recommends changing all passwords, keys, and other secrets that may have been exposed.

Delays and Zero-Day Status Unclear

The timeline of the attack and the availability of fixes is still murky. The release notes for 7.25beta3 carry a changelog date of September 2, while the beta and other initial fixes were announced on September 3. The Hacker News compared these announcements with CERT’s attack timeline on September 6 and found that the dates don’t establish whether a patch was public before the attacks began. That means the zero-day status of the vulnerabilities remains unverified.

Neither CERT’s warning nor MikroTik’s disclosure explicitly identifies which two vulnerabilities are used in the observed chain, or how they combine to grant administrative control. The Hacker News has reached out to both CERT Polska and MikroTik for comment, but no further details have been released.

Why It Matters for Router Owners

The attack is a stark reminder that internet-exposed management interfaces are a glaring vulnerability, especially on devices that are often left with default settings or outdated firmware. For MikroTik users, the stakes are immediate: a compromised router can give attackers a foothold in the internal network, allowing them to intercept traffic, pivot to other systems, or use the device for further malicious activity.

The difficulty of detecting such breaches — especially when attackers are careful — means that admins should assume that an unpatched, exposed router is at risk. The vague disclosure also leaves gaps, but the steps CERT Polska has outlined are actionable: patch, scrutinize the system for signs of intrusion, and if in doubt, treat the device as compromised. In a world where routers are often the first line of defense, leaving them unpatched is a gamble that may not pay off.