Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)

Attackers Hijack MikroTik Routers Through Internet-Exposed (TL-2026-2345), also tracked as MikroTrick, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-09-06 and last reviewed 2026-09-11. It has no confirmed attribution, affects MikroTik RouterOS, references 6 CVEs (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277), maps to 31 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-2345

Threat ID
TL-2026-2345
Also known as
MikroTrick
Severity
CRITICAL
CVSS
9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-06
Last reviewed
2026-09-11
Attribution confidence
MEDIUM
Motivation
UNKNOWN
Target sectors
telecoms, enterprise, it - isp, small-business, education, government administration
Target regions
Worldwide
Detection rules
9
Indicators of compromise
23
Updates
2026-09-11 · 4 updates · revalidated 4× · latest source

CERT Polska discovered six vulnerabilities in MikroTik RouterOS, with two chained as 'MikroTrick' (CVE-2026-67276 + CVE-2026-86060) enabling unauthenticated attackers to gain full administrative control over internet-exposed SSH interfaces. Active exploitation since at least September 2, 2026. Affects RouterOS 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1. Patches issued in versions 6.49.21, 7.23.4/7.23.5, 7.24.2, and 7.25beta3.

How Attackers Hijack MikroTik Routers Through Internet-Exposed works

On September 5, 2026, CERT Polska disclosed six critical vulnerabilities in MikroTik RouterOS discovered under OpenAI's GTAC program using LLM agents (GPT-5.5-cyber, GPT-5.6-sol) against an isolated MikroTik hardware lab. Two of these vulnerabilities form a chain dubbed 'MikroTrick' that allows an unauthenticated remote attacker to take full administrative control of any MikroTik router with SSH exposed to the internet, without any credentials.

The first vulnerability in the chain, CVE-2026-67276 (CVSS 9.2, CWE-347), is an SSH authentication bypass in RouterOS's RSA public key verification. The SSH daemon checks the key type and modulus of a user's authorized RSA key but omits the exponent. An attacker who knows the RSA modulus of an authorized user can supply a public key with exponent 1, forge a valid PKCS#1 v1.5 signature using integer cube root arithmetic, and authenticate as that user without the private key. The second vulnerability, CVE-2026-86060 (CVSS 9.2, CWE-88), is an argument injection flaw in the SSH login path. When a username begins with a disallowed character like '-', the login binary reads trusted policy material from the corresponding file descriptor. A crafted username of '-2' causes it to read from fd 2 (stderr, which duplicates the PTY slave in interactive sessions), allowing the attacker to inject a full administrative policy mask (0x9fe6e / 654958 decimal) via NUL-delimited input through the PTY. Combined, these two flaws grant unauthenticated, privilege-escalated SSH access to the full RouterOS administrative shell.

A third unrelated vulnerability, CVE-2026-67277 (CVSS 8.8, CWE-306), affects the bandwidth-test (btest) service. RouterOS accepts a 'related' btest connection before the primary session has authenticated, allowing an unauthenticated client to start an IPv4 UDP test. With random-data disabled, the sender transmits uninitialized tail data from kernel packet buffers, causing kernel memory disclosure. An additional integer underflow in packet-size validation can produce anomalously large fragmented output, crashing and restarting the RouterOS kernel. Three additional undisclosed vulnerabilities affect X.509 certificate handling and the WebFig interface.

Active exploitation has been confirmed since at least September 2, 2026, with source IP 82.192.72.4 observed conducting successful attacks including the creation of a highly privileged user named 'ops' in the 'full' group. A second IP, 103.102.31.18, was observed in exploitation attempts. Attackers used the -2 username vector to escalate privileges, then created persistent backdoor accounts, configured malicious scheduler entries combining fetch and import commands from C2 domains (mythtime.xyz, leappoach.info, eeongous.com), and enabled SOCKS proxies on compromised devices. The RouterOS 'mtget' binary (TFTP client) also contains a stack buffer overflow exploitable via ROP to achieve code execution, though this requires prior authenticated access with the 'test' policy.

MikroTik released fixes on September 3, 2026, through their security bulletin and for the first time sent push notifications to users via the MikroTik mobile app. The firmware now includes a 'Flagged' mechanism that scans for known compromise indicators at startup, disabling malicious configuration and logging critical alerts. CERT Polska recommends immediate patching, disabling SSH exposure from the internet, and thorough post-patch auditing for the documented indicators of compromise.

MITRE ATT&CK techniques used in TL-2026-2345

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1021 Remote Services: SSH; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal: Timestomp; T1078 Valid Accounts; T1556 Modify Authentication Process; T1556 Modify Authentication Process: Network Device Authentication; T1562 Impair Defenses: Disable or Modify Tools

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1059 Command and Scripting Interpreter: Network Device CLI

Persistence

T1053 Scheduled Task/Job; T1053 Scheduled Task/Job: Scheduled Task; T1078 Valid Accounts: Local Accounts; T1098 Account Manipulation; T1136 Create Account: Local Account; T1543 Create or Modify System Process

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1071 Application Layer Protocol: Web Protocols; T1090 Proxy: External Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores

Impact

T1496 Resource Hijacking; T1499 Endpoint Denial of Service; T1499 Endpoint Denial of Service: Application or System Exploitation

Reconnaissance

T1595 Active Scanning: Vulnerability Scanning

Affected products and versions in Attackers Hijack MikroTik Routers Through Internet-Exposed

  • MikroTik — RouterOS
    Vulnerable versions: 6.0.0 - 6.49.20; 7.0.0 - 7.23.3; 7.24 - 7.24.1
    Fixed in: 6.49.21; 7.23.4; 7.23.5; 7.24.2; 7.25beta3

Remediation for Attackers Hijack MikroTik Routers Through Internet-Exposed

Patches

  • RouterOS 6.49.21 (Long-term branch)
  • RouterOS 7.23.4/7.23.5 (Long-term branch; 7.23.5 fixes IPv6 DHCP regression in 7.23.4)
  • RouterOS 7.24.2 (Stable branch)
  • RouterOS 7.25beta3 (Development branch)

Immediate actions

  • Upgrade RouterOS to patched version 6.49.21, 7.23.4/7.23.5, or 7.24.2 immediately via the 'Check for updates' menu
  • Run /system/device-mode/print to check for Flagged status after upgrade
  • Inspect logs for 'ssh:-2@' indicators and unexpected 'ops' user accounts
  • Disable SSH exposure from the internet or restrict to trusted management networks
  • Block attacker IPs 82.192.72.4 and 103.102.31.18 at the perimeter firewall
  • Block domains mythtime.xyz, leappoach.info, and eeongous.com at DNS and proxy level
  • Audit for unknown scripts, scheduler tasks, proxy servers, tunnels, and PPTP/L2TP/IPsec configurations
  • Do not use built-in SSH client (/system ssh, /system ssh-exec) from an unpatched device
  • Do not initiate TLS connections from an unpatched device over untrusted networks

Workarounds

  • Disable SSH, WWW/WWW-SSL, and bandwidth-test services from untrusted networks
  • Restrict management access to trusted IP ranges via firewall filter rules
  • If compromised, isolate the device, preserve logs and configuration before resetting, then factory reset and rebuild from a trusted verified configuration
  • Do not blindly restore full backups from a potentially compromised device
  • Do not clear the Flagged marker until evidence preservation and analysis are complete
  • Change all passwords, keys, and secrets after remediation

Longer-term hardening

  • Replace RSA SSH keys with exponent 3 with Ed25519 or ECDSA keys
  • Implement network segmentation for router management interfaces
  • Deploy centralized logging and monitoring for RouterOS device configurations
  • Establish VPN-based management access instead of public SSH
  • Review and remove unnecessary user policies, especially the 'test' policy
  • Disable unneeded services: bandwidth-test, MAC-Telnet, WWW/WWW-SSL on WAN interfaces
  • Implement RADIUS AAA with proper input validation for all usernames

CVEs associated with Attackers Hijack MikroTik Routers Through Internet-Exposed

CVE-2026-67276, CVE-2026-86060, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281

Weaknesses (CWE) in Attackers Hijack MikroTik Routers Through Internet-Exposed

CWE-347, CWE-88, CWE-306, CWE-841, CWE-824

Timeline of Attackers Hijack MikroTik Routers Through Internet-Exposed

Showing the 20 most recent tracked events.

  • CERT Polska initiates AI-assisted vulnerability research on MikroTik RouterOS using GPT-5.5-cyber and GPT-5.6-sol models under the OpenAI GTAC program.
  • CVE-2026-67277 formally reserved by CERT Polska, the earliest documented step in the coordinated disclosure timeline.
  • CERT Polska completes its coordinated vulnerability disclosure process with MikroTik, handing over findings from the GTAC-model-assisted research ahead of public advisory.
  • MikroTik released 7.25beta3 with security fixes; changelog references SSH internal process refactoring
  • First observed attacks at 08:00 UTC: attacker IP 82.192.72.4 exploited the MikroTrick chain to create the 'ops' backdoor user account in the 'full' group on a MikroTik router
  • MikroTik released RouterOS 6.49.21 for the Long-term v6 branch, patching the same vulnerabilities for legacy devices
  • MikroTik released 7.23.5 to fix an IPv6 DHCP regression introduced in 7.23.4 while retaining the security fix
  • MikroTik published security bulletin and released fixed versions: 7.23.4 (Long-term) and 7.24.2 (Stable); first use of push notifications via MikroTik mobile app
  • MikroTik releases point-fix 7.23.5; researcher Nick Pratley begins reverse engineering the silently released patches by diffing dynamic symbol tables across NPK binaries.
  • ShadowServer Foundation reports 122,500+ MikroTik devices with SSH exposed on the internet; top countries Brazil (~11,300), United States (~7,100), Indonesia (~7,100), Czech Republic (~6,300), and Ukraine (~5,100).
  • Latvia's national CERT issues an alert corroborating a marked increase in attacker activity targeting MikroTik routers, confirming the campaign extends beyond CERT Polska's original observations.
  • CVE records published to NVD for CVE-2026-67276 (CVSS 9.2), CVE-2026-86060 (CVSS 9.2), and CVE-2026-67277 (CVSS 8.8).
  • CERT Polska published official advisory detailing six vulnerabilities in MikroTik RouterOS, including the MikroTrick chain (CVE-2026-67276 + CVE-2026-86060) and CVE-2026-67277 (bandwidth-test); CVEs published to NVD. Vulnerabilities discovered under OpenAI GTAC program using LLM agents
  • Independent researcher (Tolmo) reproduces the full MikroTrick exploit chain end-to-end using only the CERT Polska advisory and patch diff, publishing a public proof-of-concept for controlled testing.
  • Security Affairs publishes public warning on compromise indicators; industry researcher Raiu estimates a working PoC within 1-2 days; four tested AI tools (Astra, Sol, Daybreak Blue, GLM-5.3) failed to reproduce the exploit autonomously.
  • The Hacker News published public coverage of the MikroTrick attacks; security researcher Nick Pratley published detailed reverse engineering analysis of the 7.23.4 silent patch, including ROP proof-of-concept for mtget stack buffer overflow
  • BleepingComputer and Help Net Security report on active exploitation, publishing the observed attacker source IPs (82.192.72.4, 103.102.31.18) and the 'ops' account / '-2' username log indicators.
  • CISA adds CVE-2026-67277 and CVE-2026-86060 to the Known Exploited Vulnerabilities catalog, invoking BOD 26-04's 3-day remediation window with mandatory forensic triage for CVE-2026-86060.
  • GBHackers publishes coverage of the CISA KEV addition; NVD records last-modified updates for both CVE entries the same day.
  • Federal Civilian Executive Branch agency deadline under CISA BOD 26-04 to remediate CVE-2026-67277 and CVE-2026-86060 and, for CVE-2026-86060, complete forensic triage of potentially affected RouterOS assets.

Update history for TL-2026-2345

Sources cited for Attackers Hijack MikroTik Routers Through Internet-Exposed

More in vulnerability

Detection coverage for TL-2026-2345

As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2345 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats