Attackers are hijacking MikroTik routers over exposed SSH

Attackers are taking over MikroTik routers that expose SSH to the internet, seizing full administrative control with no credentials. The Hacker News reports that CERT Polska raised the alarm after attacks were seen from 2 September 2026, and MikroTik has shipped RouterOS updates for the affected versions.

What happened

The targets are MikroTik devices with the SSH service reachable from the public internet. Where that exposure exists, attackers are gaining administrative access to RouterOS without authenticating. MikroTik hardware is everywhere, from small offices to ISPs, which makes internet-wide scanning cheap and the pool of vulnerable devices large.

Edge devices are attractive precisely because they are forgotten. A router gets installed once, works for years, and nobody revisits its exposed services. That neglect is the vulnerability as much as any single bug.

Why owning the router is so serious

A router is not just another host. It is the control point for everything behind it, and administrative access to it hands an attacker capabilities a compromised workstation never would:

• Traffic redirection: reroute or mirror traffic to intercept credentials and sessions.
• DNS and NAT manipulation: quietly send users to phishing or malware infrastructure.
• A hidden pivot: use the router as a stable, trusted launch point deeper into the internal network.
• Persistence: alter firmware, scripts and scheduler tasks so access survives a reboot.
• Botnet conscription: MikroTik devices have repeatedly been herded into large botnets for DDoS and proxying.

This is the classic pattern we surface in engagements: one small exposed service, enormous blast radius. Finding that exposure before an attacker does is the entire point of external network penetration testing.

Our take

In most perimeter reviews we run, the highest-impact finding is not an exotic exploit. It is a management interface that should never have faced the internet: SSH, Winbox, RDP, an admin panel. Attackers know this, so they scan for exactly these services continuously. The lesson from the MikroTik campaign is not really about one vendor; it is that any management plane exposed to the internet is a countdown timer.

Assume, too, that patching alone is not closure. If a device was reachable and vulnerable during the exposure window, treat it as potentially compromised and hunt for changes rather than trusting that an update rewinds the clock.

What to do right now

• Update RouterOS immediately to the fixed release for your version.
• Take SSH and every management interface off the public internet. Bind them to a VPN or a strict IP allowlist, not 0.0.0.0.
• Assume the box may already be touched. Review accounts, scripts, scheduler entries, firewall rules and any new tunnels for anything you did not create.
• Map what an attacker could reach from the edge inward with an internal network penetration test.
• If you find signs of compromise, our compromised server recovery team contains it, rebuilds the device from trusted firmware and confirms the network is clean.
• Put continuous eyes on the perimeter with a managed SOC so the next exposed service is caught the day it appears.

The bigger picture

Perimeter security has quietly become network-device security. Firewalls, routers, VPN gateways and load balancers are now among the most-attacked assets on the internet, because compromising one bypasses everything behind it. An external test that actually probes every exposed service by hand, and an inventory that tells you what is even listening, is the difference between finding this yourself and reading about your own breach.

We track offensive-security research closely, and for readers who want to go deeper on technique we recommend the penetration testing section at SecurityLab alongside our own write-ups.

Test your perimeter