# Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (MikroTrick)

> CERT Polska discovered six vulnerabilities in MikroTik RouterOS, with two chained as 'MikroTrick' (CVE-2026-67276 + CVE-2026-86060) enabling unauthenticated attackers to gain full administrative control over internet-exposed SSH interfaces. Active exploitation since at least September 2, 2026. Affects RouterOS 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1. Patches issued in versions 6.49.21, 7.23.4/7.23.5, 7.24.2, and 7.25beta3.

- **Published:** 2026-09-06T00:00:00Z
- **Last reviewed:** 2026-09-11T12:11:25.040Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2345
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-mikrotrick-routeros-ssh-bypass-tl-2026-2345.webp?v=9ebab518 (Threadlinqs threat intel: MikroTrick RouterOS SSH Bypass: Detection & IOCs (TL-2026-2345) — Critical severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-2345
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2026-67276, CVE-2026-86060, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281

## Description

On September 5, 2026, CERT Polska disclosed six critical vulnerabilities in MikroTik RouterOS discovered under OpenAI's GTAC program using LLM agents (GPT-5.5-cyber, GPT-5.6-sol) against an isolated MikroTik hardware lab. Two of these vulnerabilities form a chain dubbed 'MikroTrick' that allows an unauthenticated remote attacker to take full administrative control of any MikroTik router with SSH exposed to the internet, without any credentials.

The first vulnerability in the chain, CVE-2026-67276 (CVSS 9.2, CWE-347), is an SSH authentication bypass in RouterOS's RSA public key verification. The SSH daemon checks the key type and modulus of a user's authorized RSA key but omits the exponent. An attacker who knows the RSA modulus of an authorized user can supply a public key with exponent 1, forge a valid PKCS#1 v1.5 signature using integer cube root arithmetic, and authenticate as that user without the private key. The second vulnerability, CVE-2026-86060 (CVSS 9.2, CWE-88), is an argument injection flaw in the SSH login path. When a username begins with a disallowed character like '-', the login binary reads trusted policy material from the corresponding file descriptor. A crafted username of '-2' causes it to read from fd 2 (stderr, which duplicates the PTY slave in interactive sessions), allowing the attacker to inject a full administrative policy mask (0x9fe6e / 654958 decimal) via NUL-delimited input through the PTY. Combined, these two flaws grant unauthenticated, privilege-escalated SSH access to the full RouterOS administrative shell.

A third unrelated vulnerability, CVE-2026-67277 (CVSS 8.8, CWE-306), affects the bandwidth-test (btest) service. RouterOS accepts a 'related' btest connection before the primary session has authenticated, allowing an unauthenticated client to start an IPv4 UDP test. With random-data disabled, the sender transmits uninitialized tail data from kernel packet buffers, causing kernel memory disclosure. An additional integer underflow in packet-size validation can produce anomalously large fragmented output, crashing and restarting the RouterOS kernel. Three additional undisclosed vulnerabilities affect X.509 certificate handling and the WebFig interface.

Active exploitation has been confirmed since at least September 2, 2026, with source IP 82.192.72.4 observed conducting successful attacks including the creation of a highly privileged user named 'ops' in the 'full' group. A second IP, 103.102.31.18, was observed in exploitation attempts. Attackers used the -2 username vector to escalate privileges, then created persistent backdoor accounts, configured malicious scheduler entries combining fetch and import commands from C2 domains (mythtime.xyz, leappoach.info, eeongous.com), and enabled SOCKS proxies on compromised devices. The RouterOS 'mtget' binary (TFTP client) also contains a stack buffer overflow exploitable via ROP to achieve code execution, though this requires prior authenticated access with the 'test' policy.

MikroTik released fixes on September 3, 2026, through their security bulletin and for the first time sent push notifications to users via the MikroTik mobile app. The firmware now includes a 'Flagged' mechanism that scans for known compromise indicators at startup, disabling malicious configuration and logging critical alerts. CERT Polska recommends immediate patching, disabling SSH exposure from the internet, and thorough post-patch auditing for the documented indicators of compromise.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1053 Scheduled Task/Job
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1095 Non-Application Layer Protocol
- T1496 Resource Hijacking
- T1059 Command and Scripting Interpreter: Network Device CLI
- T1136 Create Account: Local Account
- T1053 Scheduled Task/Job: Scheduled Task
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1562 Impair Defenses: Disable or Modify Tools
- T1070 Indicator Removal: Timestomp
- T1552 Unsecured Credentials: Credentials In Files
- T1021 Remote Services: SSH
- T1570 Lateral Tool Transfer
- T1090 Proxy: External Proxy
- T1071 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1499 Endpoint Denial of Service
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1573 Encrypted Channel
- T1048 Exfiltration Over Alternative Protocol
- T1555 Credentials from Password Stores
- T1556 Modify Authentication Process
- T1595 Active Scanning: Vulnerability Scanning
- T1133 External Remote Services
- T1212 Exploitation for Credential Access
- T1556 Modify Authentication Process: Network Device Authentication
- T1078 Valid Accounts: Local Accounts
- T1499 Endpoint Denial of Service: Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MikroTrick C2 Communication and Resource Hijacking Detection** (`TL-2026-2345-SPL-003`)

Detects command-and-control communication patterns and resource hijacking from MikroTik routers compromised by the MikroTrick attack chain. Monitors for: (1) DNS resolution requests and HTTP/HTTPS connections to known C2 domains (mythtime.xyz, leappoach.info, eeongous.com), (2) unexpected SOCKS proxy (port 1080/TCP) traffic originating from RouterOS devices indicating protocol tunneling through compromised routers, (3) abnormal outbound traffic patterns from router management interfaces on non-standard ports, and (4) DNS queries to algorithmically-generated domains that may indicate secondary C2 infrastructure. Compromised MikroTik routers are used as SOCKS proxies for attacker operational traffic, enabling lateral movement and resource hijacking.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1572, T1496, T1095
- **Data sources:** dns_logs, proxy_logs, mikrotik_routeros_syslog, network_flow_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype=syslog "RouterOS" "socks" OR sourcetype=dns OR sourcetype=proxy)
  [search index=network sourcetype=syslog "RouterOS" "socks"
    | stats values(host) as compromised_routers
    | return $compromised_routers]
| eval threat_type=case(
    match(query,"(?i)mythtime\.xyz|leappoach\.info|eeongous\.com"),"Known C2 Domain Resolution",
    match(_raw,"socks"),"SOCKS Proxy — T1572",
    match(_raw,"port 1080"),"SOCKS Proxy Traffic — T1572",
    1=1,"Review Required"
  )
| eval c2_domain=case(
    match(query,"(?i)mythtime\.xyz"),"mythtime.xyz",
    match(query,"(?i)leappoach\.info"),"leappoach.info",
    match(query,"(?i)eeongous\.com"),"eeongous.com",
    1=1,null()
  )
| stats values(threat_type) as threat_types, values(c2_domain) as c2_domains, count by host, src_ip
| sort -count
| eval resource_hijacking=if(threat_types="SOCKS Proxy — T1572","YES — Router being used as proxy node","Monitor")
```

### Microsoft KQL

```kql
let C2Domains = dynamic(["mythtime.xyz", "leappoach.info", "eeongous.com"]);
let CompromisedRouters = (
    Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has "RouterOS"
    | where SyslogMessage has "socks"
    | project HostName = HostName
    | distinct HostName
);
// C2 Domain DNS Resolution
let DnsC2 = (
    DnsEvents
    | where TimeGenerated > ago(7d)
    | where Name in (C2Domains)
    | extend threat_type = "Known C2 Domain Resolution", c2_domain = Name
    | project TimeGenerated, ClientIP, c2_domain, threat_type, Name
);
// SOCKS Proxy Detection
let SocksProxy = (
    Syslog
    | where TimeGenerated > ago(7d)
    | where HostName in (CompromisedRouters)
    | where SyslogMessage has "socks"
    | extend threat_type = "SOCKS Proxy — T1572", c2_domain = ""
    | project TimeGenerated, HostName, threat_type, c2_domain, SyslogMessage
);
union DnsC2, SocksProxy
| extend resource_hijacking = iff(threat_type == "SOCKS Proxy — T1572", "YES — Router being used as proxy node", "Monitor")
| project TimeGenerated, SourceIP = coalesce(ClientIP, HostName), c2_domain, threat_type, resource_hijacking
| order by TimeGenerated desc
```

### Sigma

```yaml
title: MikroTrick C2 Communication and SOCKS Proxy Resource Hijacking
id: 6a8b9d4e-4f7a-b1c2-3d5e-6f7a8b9c2c3f
status: experimental
description: Detects command-and-control communication and resource hijacking patterns associated with MikroTrick-compromised MikroTik routers. Monitors DNS resolution to known C2 domains (mythtime.xyz, leappoach.info, eeongous.com) and unexpected SOCKS proxy enablement on RouterOS devices. Compromised routers are used as SOCKS proxy nodes for attacker operational traffic, constituting resource hijacking (T1496) and protocol tunneling (T1572).
references:
    - https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
    - https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html
    - https://mikrotik.com/supportsec/september-2026-vulnerability/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/06
tags:
    - attack.command-and-control
    - attack.impact
    - attack.t1071.001
    - attack.t1572
    - attack.t1095
    - attack.t1496
    - cve.2026.67276
    - cve.2026.86060
logsource:
    category: firewall
    product: mikrotik
detection:
    selection_c2_dns:
        query|contains:
            - "mythtime.xyz"
            - "leappoach.info"
            - "eeongous.com"
    selection_socks:
        message|contains:
            - "socks enabled"
            - "socks proxy"
    selection_socks_port:
        dst_port: 1080
    condition: selection_c2_dns or selection_socks or selection_socks_port
falsepositives:
    - Authorized SOCKS proxy configuration for legitimate network monitoring or traffic engineering purposes
    - Benign DNS queries to domains sharing substrings with C2 domains (extremely unlikely for these specific TLDs)
level: high
```

**Known false positives:**

- Authorized SOCKS proxy for legitimate network monitoring or traffic engineering
- Benign DNS queries to unrelated domains that coincidentally share substrings with C2 domains
- Legitimate HTTPS traffic to domains hosted on same infrastructure as C2 (shared hosting scenarios)

**Tuning notes:** Correlate DNS queries to C2 domains with RouterOS device syslog to confirm compromise. SOCKS proxy on port 1080/TCP originating from a router management interface is highly suspicious unless explicitly authorized. Combine with netflow analysis to identify traffic routed through compromised SOCKS proxies. Create watchlist of known C2 domains and alert on first DNS resolution attempt for proactive detection.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MikroTrick SSH Exploitation — Microsoft Sentinel Detection (locked: unlock with TL Creds)
- MikroTrick Post-Exploitation Persistence — Microsoft Sentinel Detection (locked: unlock with TL Creds)
- MikroTrick C2 Beaconing and Protocol Tunneling — Microsoft Sentinel Detection (locked: unlock with TL Creds)
- MikroTrick SSH RSA Authentication Bypass and Privilege Escalation (locked: unlock with TL Creds)
- MikroTrick Post-Exploitation — Backdoor Account and C2 Scheduler Entries on RouterOS (locked: unlock with TL Creds)
- MikroTrick C2 Communication and SOCKS Proxy Tunneling Detection (locked: unlock with TL Creds)
- MikroTrick SSH Authentication Bypass — Crafted Username Detection (locked: unlock with TL Creds)
- MikroTrick Post-Exploitation — Backdoor Account and Scheduler Persistence (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `82.192.72[.]4`
- Domain: `mythtime[.]xyz`
- File hash: `6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CERT Polska: Critical Vulnerabilities in MikroTik RouterOS Actively Exploited](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)
- [CERT Polska: MikroTik RouterOS CVE Details](https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/)
- [MikroTik: September 2026 Security Vulnerability](https://mikrotik.com/supportsec/september-2026-vulnerability/)
- [The Hacker News: Attackers Hijack MikroTik Routers Through Internet-Exposed SSH](https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html)
- [Nick Pratley: Reversing MikroTik's Silent Patch — The RouterOS 7.23.4 Fix They Wouldn't Explain](https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/)
- [NVD: CVE-2026-67276](https://nvd.nist.gov/vuln/detail/cve-2026-67276)
- [NVD: CVE-2026-86060](https://nvd.nist.gov/vuln/detail/cve-2026-86060)
- [NVD: CVE-2026-67277](https://nvd.nist.gov/vuln/detail/cve-2026-67277)
- [CyberSecurity News: MikroTik RouterOS Vulnerability](https://cybersecuritynews.com/mikrotik-routeros-vulnerability/)
- [MikroTik Forum: 7.23.4 Long-term Release](https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801)
- [MikroTik Forum: 7.24.2 Stable Release](https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800)
- [MikroTik Forum: 6.49.21 Long-term Release](https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2345