Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)

Key facts for MikroTrick RouterOS SSH bypass

Detection coverage for MikroTrick RouterOS SSH bypass

As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2345 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MikroTrick C2 Communication and Resource Hijacking Detection

Detects command-and-control communication patterns and resource hijacking from MikroTik routers compromised by the MikroTrick attack chain. Monitors for: (1) DNS resolution requests and HTTP/HTTPS connections to known C2 domains (mythtime.xyz, leappoach.info, eeongous.com), (2) unexpected SOCKS proxy (port 1080/TCP) traffic originating from RouterOS devices indicating protocol tunneling through compromised routers, (3) abnormal outbound traffic patterns from router management interfaces on non-standard ports, and (4) DNS queries to algorithmically-generated domains that may indicate secondary C2 infrastructure. Compromised MikroTik routers are used as SOCKS proxies for attacker operational traffic, enabling lateral movement and resource hijacking.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1572, T1496, T1095
• Data sources: dns_logs, proxy_logs, mikrotik_routeros_syslog, network_flow_logs
• Severity: high
• Confidence: high

Splunk SPL

index=network (sourcetype=syslog "RouterOS" "socks" OR sourcetype=dns OR sourcetype=proxy)
  [search index=network sourcetype=syslog "RouterOS" "socks"
    | stats values(host) as compromised_routers
    | return $compromised_routers]
| eval threat_type=case(
    match(query,"(?i)mythtime\.xyz|leappoach\.info|eeongous\.com"),"Known C2 Domain Resolution",
    match(_raw,"socks"),"SOCKS Proxy — T1572",
    match(_raw,"port 1080"),"SOCKS Proxy Traffic — T1572",
    1=1,"Review Required"
  )
| eval c2_domain=case(
    match(query,"(?i)mythtime\.xyz"),"mythtime.xyz",
    match(query,"(?i)leappoach\.info"),"leappoach.info",
    match(query,"(?i)eeongous\.com"),"eeongous.com",
    1=1,null()
  )
| stats values(threat_type) as threat_types, values(c2_domain) as c2_domains, count by host, src_ip
| sort -count
| eval resource_hijacking=if(threat_types="SOCKS Proxy — T1572","YES — Router being used as proxy node","Monitor")

Microsoft KQL

let C2Domains = dynamic(["mythtime.xyz", "leappoach.info", "eeongous.com"]);
let CompromisedRouters = (
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has "RouterOS"
    | where SyslogMessage has "socks"
    | project HostName = HostName
    | distinct HostName
);
// C2 Domain DNS Resolution
let DnsC2 = (
    DnsEvents
    | where TimeGenerated > ago(7d)
    | where Name in (C2Domains)
    | extend threat_type = "Known C2 Domain Resolution", c2_domain = Name
    | project TimeGenerated, ClientIP, c2_domain, threat_type, Name
);
// SOCKS Proxy Detection
let SocksProxy = (
    Syslog
    | where TimeGenerated > ago(7d)
    | where HostName in (CompromisedRouters)
    | where SyslogMessage has "socks"
    | extend threat_type = "SOCKS Proxy — T1572", c2_domain = ""
    | project TimeGenerated, HostName, threat_type, c2_domain, SyslogMessage
);
union DnsC2, SocksProxy
| extend resource_hijacking = iff(threat_type == "SOCKS Proxy — T1572", "YES — Router being used as proxy node", "Monitor")
| project TimeGenerated, SourceIP = coalesce(ClientIP, HostName), c2_domain, threat_type, resource_hijacking
| order by TimeGenerated desc

Sigma

title: MikroTrick C2 Communication and SOCKS Proxy Resource Hijacking
id: 6a8b9d4e-4f7a-b1c2-3d5e-6f7a8b9c2c3f
status: experimental
description: Detects command-and-control communication and resource hijacking patterns associated with MikroTrick-compromised MikroTik routers. Monitors DNS resolution to known C2 domains (mythtime.xyz, leappoach.info, eeongous.com) and unexpected SOCKS proxy enablement on RouterOS devices. Compromised routers are used as SOCKS proxy nodes for attacker operational traffic, constituting resource hijacking (T1496) and protocol tunneling (T1572).
references:
    - https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
    - https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html
    - https://mikrotik.com/supportsec/september-2026-vulnerability/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/06
tags:
    - attack.command-and-control
    - attack.impact
    - attack.t1071.001
    - attack.t1572
    - attack.t1095
    - attack.t1496
    - cve.2026.67276
    - cve.2026.86060
logsource:
    category: firewall
    product: mikrotik
detection:
    selection_c2_dns:
        query|contains:
            - "mythtime.xyz"
            - "leappoach.info"
            - "eeongous.com"
    selection_socks:
        message|contains:
            - "socks enabled"
            - "socks proxy"
    selection_socks_port:
        dst_port: 1080
    condition: selection_c2_dns or selection_socks or selection_socks_port
falsepositives:
    - Authorized SOCKS proxy configuration for legitimate network monitoring or traffic engineering purposes
    - Benign DNS queries to domains sharing substrings with C2 domains (extremely unlikely for these specific TLDs)
level: high

Known false positives:

• Authorized SOCKS proxy for legitimate network monitoring or traffic engineering
• Benign DNS queries to unrelated domains that coincidentally share substrings with C2 domains
• Legitimate HTTPS traffic to domains hosted on same infrastructure as C2 (shared hosting scenarios)

Tuning notes: Correlate DNS queries to C2 domains with RouterOS device syslog to confirm compromise. SOCKS proxy on port 1080/TCP originating from a router management interface is highly suspicious unless explicitly authorized. Combine with netflow analysis to identify traffic routed through compromised SOCKS proxies. Create watchlist of known C2 domains and alert on first DNS resolution attempt for proactive detection.

• 🔒 MikroTrick SSH Exploitation — Microsoft Sentinel Detection · unlock with TL Creds
• 🔒 MikroTrick Post-Exploitation Persistence — Microsoft Sentinel Detection · unlock with TL Creds
• 🔒 MikroTrick C2 Beaconing and Protocol Tunneling — Microsoft Sentinel Detection · unlock with TL Creds
• 🔒 MikroTrick SSH RSA Authentication Bypass and Privilege Escalation · unlock with TL Creds
• 🔒 MikroTrick Post-Exploitation — Backdoor Account and C2 Scheduler Entries on RouterOS · unlock with TL Creds
• 🔒 MikroTrick C2 Communication and SOCKS Proxy Tunneling Detection · unlock with TL Creds
• 🔒 MikroTrick SSH Authentication Bypass — Crafted Username Detection · unlock with TL Creds
• 🔒 MikroTrick Post-Exploitation — Backdoor Account and Scheduler Persistence · unlock with TL Creds

Indicators of compromise for MikroTrick RouterOS SSH bypass

As of 2026-09-11, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-2345.

Sample indicators (3 of 23)

• IP address: 82.192.72[.]4
• Domain: mythtime[.]xyz
• File hash: 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

How MikroTrick RouterOS SSH bypass works

Patches issued in versions 6.49.21, 7.23.4/7.23.5, 7.24.2, and 7.25beta3.

On September 5, 2026, CERT Polska disclosed six critical vulnerabilities in MikroTik RouterOS discovered under OpenAI's GTAC program using LLM agents (GPT-5.5-cyber, GPT-5.6-sol) against an isolated MikroTik hardware lab. Two of these vulnerabilities form a chain dubbed 'MikroTrick' that allows an unauthenticated remote attacker to take full administrative control of any MikroTik router with SSH exposed to the internet, without any credentials.

The first vulnerability in the chain, CVE-2026-67276 (CVSS 9.2, CWE-347), is an SSH authentication bypass in RouterOS's RSA public key verification. The SSH daemon checks the key type and modulus of a user's authorized RSA key but omits the exponent. An attacker who knows the RSA modulus of an authorized user can supply a public key with exponent 1, forge a valid PKCS#1 v1.5 signature using integer cube root arithmetic, and authenticate as that user without the private key. The second vulnerability, CVE-2026-86060 (CVSS 9.2, CWE-88), is an argument injection flaw in the SSH login path. When a username begins with a disallowed character like '-', the login binary reads trusted policy material from the corresponding file descriptor. A crafted username of '-2' causes it to read from fd 2 (stderr, which duplicates the PTY slave in interactive sessions), allowing the attacker to inject a full administrative policy mask (0x9fe6e / 654958 decimal) via NUL-delimited input through the PTY. Combined, these two flaws grant unauthenticated, privilege-escalated SSH access to the full RouterOS administrative shell.

A third unrelated vulnerability, CVE-2026-67277 (CVSS 8.8, CWE-306), affects the bandwidth-test (btest) service. RouterOS accepts a 'related' btest connection before the primary session has authenticated, allowing an unauthenticated client to start an IPv4 UDP test. With random-data disabled, the sender transmits uninitialized tail data from kernel packet buffers, causing kernel memory disclosure. An additional integer underflow in packet-size validation can produce anomalously large fragmented output, crashing and restarting the RouterOS kernel. Three additional undisclosed vulnerabilities affect X.509 certificate handling and the WebFig interface.

Active exploitation has been confirmed since at least September 2, 2026, with source IP 82.192.72.4 observed conducting successful attacks including the creation of a highly privileged user named 'ops' in the 'full' group. A second IP, 103.102.31.18, was observed in exploitation attempts. Attackers used the -2 username vector to escalate privileges, then created persistent backdoor accounts, configured malicious scheduler entries combining fetch and import commands from C2 domains (mythtime.xyz, leappoach.info, eeongous.com), and enabled SOCKS proxies on compromised devices. The RouterOS 'mtget' binary (TFTP client) also contains a stack buffer overflow exploitable via ROP to achieve code execution, though this requires prior authenticated access with the 'test' policy.

MikroTik released fixes on September 3, 2026, through their security bulletin and for the first time sent push notifications to users via the MikroTik mobile app. The firmware now includes a 'Flagged' mechanism that scans for known compromise indicators at startup, disabling malicious configuration and logging critical alerts. CERT Polska recommends immediate patching, disabling SSH exposure from the internet, and thorough post-patch auditing for the documented indicators of compromise.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1021 Remote Services: SSH; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal: Timestomp; T1078 Valid Accounts; T1556 Modify Authentication Process; T1556 Modify Authentication Process: Network Device Authentication; T1562 Impair Defenses: Disable or Modify Tools

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1059 Command and Scripting Interpreter: Network Device CLI

Persistence

T1053 Scheduled Task/Job; T1053 Scheduled Task/Job: Scheduled Task; T1078 Valid Accounts: Local Accounts; T1098 Account Manipulation; T1136 Create Account: Local Account; T1543 Create or Modify System Process

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1071 Application Layer Protocol: Web Protocols; T1090 Proxy: External Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores

Impact

T1496 Resource Hijacking; T1499 Endpoint Denial of Service; T1499 Endpoint Denial of Service: Application or System Exploitation

Reconnaissance

T1595 Active Scanning: Vulnerability Scanning

Remediation for MikroTrick RouterOS SSH bypass

Patches

• RouterOS 6.49.21 (Long-term branch)
• RouterOS 7.23.4/7.23.5 (Long-term branch; 7.23.5 fixes IPv6 DHCP regression in 7.23.4)
• RouterOS 7.24.2 (Stable branch)
• RouterOS 7.25beta3 (Development branch)

Immediate actions

• Upgrade RouterOS to patched version 6.49.21, 7.23.4/7.23.5, or 7.24.2 immediately via the 'Check for updates' menu
• Run /system/device-mode/print to check for Flagged status after upgrade
• Inspect logs for 'ssh:-2@' indicators and unexpected 'ops' user accounts
• Disable SSH exposure from the internet or restrict to trusted management networks
• Block attacker IPs 82.192.72.4 and 103.102.31.18 at the perimeter firewall
• Block domains mythtime.xyz, leappoach.info, and eeongous.com at DNS and proxy level
• Audit for unknown scripts, scheduler tasks, proxy servers, tunnels, and PPTP/L2TP/IPsec configurations
• Do not use built-in SSH client (/system ssh, /system ssh-exec) from an unpatched device
• Do not initiate TLS connections from an unpatched device over untrusted networks

Workarounds

• Disable SSH, WWW/WWW-SSL, and bandwidth-test services from untrusted networks
• Restrict management access to trusted IP ranges via firewall filter rules
• If compromised, isolate the device, preserve logs and configuration before resetting, then factory reset and rebuild from a trusted verified configuration
• Do not blindly restore full backups from a potentially compromised device
• Do not clear the Flagged marker until evidence preservation and analysis are complete
• Change all passwords, keys, and secrets after remediation

Longer-term hardening

• Replace RSA SSH keys with exponent 3 with Ed25519 or ECDSA keys
• Implement network segmentation for router management interfaces
• Deploy centralized logging and monitoring for RouterOS device configurations
• Establish VPN-based management access instead of public SSH
• Review and remove unnecessary user policies, especially the 'test' policy
• Disable unneeded services: bandwidth-test, MAC-Telnet, WWW/WWW-SSL on WAN interfaces
• Implement RADIUS AAA with proper input validation for all usernames

Affected and fixed versions

• MikroTik — RouterOS
  Vulnerable versions: 6.0.0 - 6.49.20; 7.0.0 - 7.23.3; 7.24 - 7.24.1
  Fixed in: 6.49.21; 7.23.4; 7.23.5; 7.24.2; 7.25beta3

Timeline of MikroTrick RouterOS SSH bypass

Last updated 2026-09-11 · 4 updates · revalidated 4× · latest source

Showing the 20 most recent tracked events.

• 2026-01-01 CERT Polska initiates AI-assisted vulnerability research on MikroTik RouterOS using GPT-5.5-cyber and GPT-5.6-sol models under the OpenAI GTAC program.
• 2026-07-29 CVE-2026-67277 formally reserved by CERT Polska, the earliest documented step in the coordinated disclosure timeline.
• 2026-08-01 CERT Polska completes its coordinated vulnerability disclosure process with MikroTik, handing over findings from the GTAC-model-assisted research ahead of public advisory.
• 2026-09-02 MikroTik released 7.25beta3 with security fixes; changelog references SSH internal process refactoring
• 2026-09-02 First observed attacks at 08:00 UTC: attacker IP locked-ioc-19 exploited the MikroTrick chain to create the 'ops' backdoor user account in the 'full' group on a MikroTik router
• 2026-09-03 MikroTik released RouterOS 6.49.21 for the Long-term v6 branch, patching the same vulnerabilities for legacy devices
• 2026-09-03 MikroTik released 7.23.5 to fix an IPv6 DHCP regression introduced in 7.23.4 while retaining the security fix
• 2026-09-03 MikroTik published security bulletin and released fixed versions: 7.23.4 (Long-term) and 7.24.2 (Stable); first use of push notifications via MikroTik mobile app
• 2026-09-04 MikroTik releases point-fix 7.23.5; researcher Nick Pratley begins reverse engineering the silently released patches by diffing dynamic symbol tables across NPK binaries.
• 2026-09-05 ShadowServer Foundation reports 122,500+ MikroTik devices with SSH exposed on the internet; top countries Brazil (~11,300), United States (~7,100), Indonesia (~7,100), Czech Republic (~6,300), and Ukraine (~5,100).
• 2026-09-05 Latvia's national CERT issues an alert corroborating a marked increase in attacker activity targeting MikroTik routers, confirming the campaign extends beyond CERT Polska's original observations.
• 2026-09-05 CVE records published to NVD for CVE-2026-67276 (CVSS 9.2), CVE-2026-86060 (CVSS 9.2), and CVE-2026-67277 (CVSS 8.8).
• 2026-09-05 CERT Polska published official advisory detailing six vulnerabilities in MikroTik RouterOS, including the MikroTrick chain (CVE-2026-67276 + CVE-2026-86060) and CVE-2026-67277 (bandwidth-test); CVEs published to NVD. Vulnerabilities discovered under OpenAI GTAC program using LLM agents
• 2026-09-06 Independent researcher (Tolmo) reproduces the full MikroTrick exploit chain end-to-end using only the CERT Polska advisory and patch diff, publishing a public proof-of-concept for controlled testing.
• 2026-09-06 Security Affairs publishes public warning on compromise indicators; industry researcher Raiu estimates a working PoC within 1-2 days; four tested AI tools (Astra, Sol, Daybreak Blue, GLM-5.3) failed to reproduce the exploit autonomously.
• 2026-09-06 The Hacker News published public coverage of the MikroTrick attacks; security researcher Nick Pratley published detailed reverse engineering analysis of the 7.23.4 silent patch, including ROP proof-of-concept for mtget stack buffer overflow
• 2026-09-07 BleepingComputer and Help Net Security report on active exploitation, publishing the observed attacker source IPs (locked-ioc-19, locked-ioc-15) and the 'ops' account / '-2' username log indicators.
• 2026-09-10 CISA adds CVE-2026-67277 and CVE-2026-86060 to the Known Exploited Vulnerabilities catalog, invoking BOD 26-04's 3-day remediation window with mandatory forensic triage for CVE-2026-86060.
• 2026-09-11 GBHackers publishes coverage of the CISA KEV addition; NVD records last-modified updates for both CVE entries the same day.
• 2026-09-13 Federal Civilian Executive Branch agency deadline under CISA BOD 26-04 to remediate CVE-2026-67277 and CVE-2026-86060 and, for CVE-2026-86060, complete forensic triage of potentially affected RouterOS assets.

Update history

• 2026-09-11 — CISA Adds Two Actively Exploited MikroTik RouterOS Flaws to KEV Catalog (CVE-2026-67277, CVE-2026-86060) — the "MikroTrick" SSH Takeover Chain: What changed No severity/exploitability/status change (already CRITICAL/ACTIVE). CISA added CVE-2026-67277 and CVE-2026-86060 to its KEV catalog on 2026-09-10, imposing a BOD 26-04 remediation deadline of 2026-09-13 (with mandatory forensic
• 2026-09-08 — CVE-2026-67276 — MikroTik RouterOS SSH Public-Key Authentication Bypass (CWE-347), exploited in the wild with CVE-2026-86060 as 'MikroTrick' chain: What changed No change to severity/exploitability/status — already CRITICAL/ACTIVE in the existing record. No escalation warranted. New indicators (0) Indicator values are withheld at this access level. New CVEs (0) None — all six CVEs and
• 2026-09-06 — MikroTik RouterOS Critical Vulnerabilities — MikroTrick Attack Chain (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277): New indicators (1) Indicator values are withheld at this access level. New MITRE (4) Four techniques added on stronger evidence in the newer report: Network Service Discovery (secondary IP observed scanning), Data from Local System and Exfi
• 2026-09-06 — MikroTrick Attack Chain — Active Exploitation of MikroTik RouterOS Vulnerabilities (CVE-2026-67276, CVE-2026-86060): What changed No change to severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), or CVSS score (9.2). Attribution confidence raised LOW → MEDIUM and threat_actor refined from 'Unattributed' to 'Unknown (infrastructure overlaps with

Sources cited for MikroTrick RouterOS SSH bypass

• CERT Polska: Critical Vulnerabilities in MikroTik RouterOS Actively Exploited cert.pl · Advisory · 2026-09-05
• CERT Polska: MikroTik RouterOS CVE Details cert.pl · Advisory · 2026-09-05
• MikroTik: September 2026 Security Vulnerability mikrotik.com · Advisory · 2026-09-03
• NVD: CVE-2026-67276 NVD (NIST) · Advisory · 2026-09-05
• NVD: CVE-2026-86060 NVD (NIST) · Advisory · 2026-09-05
• NVD: CVE-2026-67277 NVD (NIST) · Advisory · 2026-09-05
• Nick Pratley: Reversing MikroTik's Silent Patch — The RouterOS 7.23.4 Fix They Wouldn't Explain npratley.net · Research · 2026-09-06
• MikroTik Forum: 7.23.4 Long-term Release forum.mikrotik.com · Vendor report · 2026-09-03
• MikroTik Forum: 7.24.2 Stable Release forum.mikrotik.com · Vendor report · 2026-09-03
• MikroTik Forum: 6.49.21 Long-term Release forum.mikrotik.com · Vendor report · 2026-09-03
• The Hacker News: Attackers Hijack MikroTik Routers Through Internet-Exposed SSH The Hacker News · News · 2026-09-06
• CyberSecurity News: MikroTik RouterOS Vulnerability cybersecuritynews.com · News · 2026-09-06

More in vulnerability

• TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released
• Active Exploitation of BTCPay Server Instances Draining Bitcoin Hot Wallets (Versions Older Than 2.4.2)
• Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)
• Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)
• Microsoft Edge Logic-Bug Full Exploit Chain Enables Code Execution Without Memory Corruption (Pwn2Own Berlin 2026, Orange Tsai; CVE-2026-45495)