MikroTik Router Hijack Alert: NC Branch Network Risk

The 60-second version: Poland's national CERT warned on September 5, 2026 that attackers are chaining two MikroTik RouterOS flaws to take complete administrative control of routers with no password, provided the box answers SSH from the internet. They have watched it work since at least September 2. MikroTik shipped fixes on September 3. Check the log before you update, because if you were already hit, updating leaves the attacker's account in place. And know which side of this line you are on: a hijacked router on a segmented warehouse network is an expensive nuisance, while the same router on a flat network that reaches your ERP and your file server is an incident with lawyers in it.

Check this before you patch anything

login failure for user -2 from ATTACKER-IP via ssh user NAME added by ssh:-2@ATTACKER-IP

That is the fingerprint CERT Polska published on September 5. A username of -2 is not a typo and not a normal event; it is the exploit's signature, and it is distinctive enough that Security Affairs led its coverage with it. The same advisory names a second artifact: a highly privileged user account called ops that nobody at your company created. CERT also published two addresses tied to the activity, 82.192.72.4 for confirmed successful attacks and 103.102.31.18 for attempts.

If either artifact is present, stop, and do not reboot the box. CERT's guidance for a suspected compromise is to isolate the device, preserve its logs and configuration, factory reset, and rebuild from a configuration you trust. An attacker with full administrative rights has had the chance to add users, scripts, scheduler tasks, proxies and tunnels, and a firmware update removes none of those.

If neither artifact is present, update and then review the configuration anyway.

No password for the router? Then that is your actual finding, and it is more common than the vulnerability. Write down who you believe holds the credentials, whether that is an internet provider, a cabling contractor or someone who left. Recovering that access is the ticket. Preferred Data Corporation: (336) 886-3282.

What is MikroTrick, exactly?

CERT Polska coordinated disclosure of six RouterOS vulnerabilities, two of them critical, and named the two-flaw takeover chain MikroTrick. Both critical flaws sit in SSH and both scored 9.2 under CVSS v4.0 in CERT Polska's own assessment; NIST has published no independent score.

CVE	CVSS	What it does
CVE-2026-67276	9.2	SSH authentication bypass. RouterOS did not properly verify public keys used for SSH authentication, so knowing a username and the modulus of that user's key can be enough to log in
CVE-2026-86060	9.2	SSH privilege escalation. RouterOS mishandles usernames beginning with a prohibited character, changing the trusted policy mask
CVE-2026-67277	8.8	Bandwidth-test flaw enabling kernel memory leakage or a remote denial of service, without authentication

CERT Polska does not say which two of the six make up MikroTrick. Researcher Costin Raiu, in Security Affairs' September coverage, points at the two SSH flaws above; chained, they would hand an unauthenticated attacker the rights your network engineer has. From there the device is a permanent, trusted vantage point: it sees every packet between the plant floor and the internet, and it survives every workstation rebuild you will ever do, which is why a router is the thing attackers keep and a laptop is the thing they burn.

Key takeaway: Rebuilding a RouterOS box after a compromise means reconstructing every firewall rule, VPN tunnel and VLAN by hand. Budget half a day, and find out now whether you have a configuration export somewhere off the device, because after a compromise you cannot trust the copy that is on it.

How exposed is this, and how fast did it move?

Shadowserver Foundation scanning counted 122,500 MikroTik devices answering SSH from the internet on September 5, as BleepingComputer reported on September 7. CERT has seen successful attacks since at least the 2nd. The patch landed on the 3rd. Nobody has published how many boxes were actually taken, or by whom; The Hacker News's September 6 review of the CERT warning found no victim count and no attribution. Both facts are worth exactly what they cost you: go check your own box.

Date, 2026	Event	What it means for a NC business
September 2	CERT Polska observes successful attacks	Exploitation preceded public disclosure. Anything exposed before this date should be treated as possibly touched
September 3	MikroTik publishes fixes in 7.25beta3, 7.24.2, 7.23.4 and 6.49.21	Patched builds existed one day after the first observed attack. CERT ran a coordinated disclosure, so MikroTik had the reports earlier; no source gives the notification date
September 4	RouterOS 7.23.5 appears on the MikroTik changelog page	A further long-term build. Sources disagree on whether .4 or .5 is the patched long-term version, so take the highest on your branch
September 5	CERT Polska publishes the advisory and the indicators	The detection artifacts became public, which is the only reason you can check today

We wrote up why edge gear ages badly in the DD-WRT botnet post. The short version applies here: RouterOS already has two entries on CISA's Known Exploited Vulnerabilities catalog, CVE-2018-14847 and CVE-2018-7445, both for flaws that were years old before anyone listed them. These boxes stay in service long after everybody stops thinking about them.

If your network gear has no owner: the difference between a morning like this being a ten-minute check and a two-week scavenger hunt is whether somebody already wrote down the make, firmware and owner of every network device on every site. That list is the point of a managed network, and it is worth building whether or not anyone manages it for you. Network infrastructure and managed IT, (336) 886-3282.

Who is supposed to be updating the router in the warehouse?

MikroTik is what gets installed when price decides, and that decision usually got made by someone who is no longer involved. The gear is genuinely capable and inexpensive, which is why it turns up in the second building, the warehouse annex, the leased space across town, the outdoor wireless link between two structures on the same lot. On a Triad manufacturing site it is rarely in the main rack in High Point and almost never on the asset list, because the box that matters is in Thomasville or Archdale where nobody from IT has been in three years.

MikroTik is not the villain here. They fixed six flaws and shipped patched builds across four release branches, with patches public one day after the first observed attack and two days before the advisory. No source publishes the disclosure timeline, so nobody outside the two organizations knows the notification-to-patch interval; what is visible is a vendor that had fixes out before most customers had heard of the problem. The failure in a North Carolina plant is that nobody in the building can name who updates it, and that SSH is answering the open internet because a machine vendor asked for a port forward during a commissioning trip and nobody wrote down that it was temporary. A forgotten rule like that is one of the most ordinary things to find on a first network review, in Greensboro or Lexington or on a distribution site outside Charlotte, and the person who asked for it has usually moved on.

The situation in most buildings	What it should be, and what it costs you
Routers appear on no asset list	Every device has an owner, and the owner is a role, not a person who might leave
SSH or the web interface answers the internet	Management reachable only over the VPN. Expect one contractor to complain in the first month, and expect them to be the reason it was open
Firmware updated when something breaks	Two reviews a year plus a named person who reads vendor advisories. If nobody reads them, the schedule is decoration
Nobody has the configuration backed up	An export stored off the device, tested by rebuilding onto a spare once
Warehouse network is flat with the plant	Segmentation, so a compromised edge device cannot see the ERP server

That last row decides how bad a day like this gets, and it is the row that takes a project rather than an afternoon.

What if we cannot update the router today?

Reduce what it answers. CERT's interim guidance is to disable the exposed services, specifically SSH, WWW and WWW-SSL, and bandwidth-test, or restrict them to trusted networks. Closing SSH removes the path for both critical flaws. Close bandwidth-test as well, because CVE-2026-67277 does not go through SSH.

Before you touch anything on that box during a shift, answer one question: what runs through it? In a plant or a warehouse the router in the closet is frequently carrying barcode scanner traffic, VoIP handsets, badge readers or the warehouse management system, and a service restart at 7am can stop shipping. Find out what depends on it, then schedule the change outside production hours with someone who can revert it.

Two more practical notes. Disabling remote management on a device you administer remotely will lock you out, so sequence it: get local or VPN access working first, then close the public path. And CERT advises against initiating TLS connections from an unpatched device, so hold off on outbound update or certificate operations from the box until it is patched.

Key takeaway: Closing the management interface to the internet is a bigger permanent win than this month's patch. A patch fixes the flaws known today. A management interface that only answers from inside your network sharply narrows who can reach the next unannounced flaw in this class.

If you find -2 in the log: do not touch the box and do not reboot it. Photograph the screen, export the configuration, and call whoever handles your incident response before anyone resets it, because the reset destroys the only record of what else the attacker reached. If that is us, the number is (336) 886-3282, and we work on-site within 200 miles of High Point.

What NC owners are asking

How do I know whether I even have MikroTik gear?

MikroTik boxes are usually small white or black units with a row of ethernet ports and no vendor support sticker, and the management tool is called WinBox. If your internet provider or a low-bid cabling contractor set up the second building, check there first, because that is where they usually turn up. Walk the buildings rather than assuming; a phone camera and 20 minutes is enough for a first pass.

Which RouterOS versions are fixed?

MikroTik released fixes on September 3, 2026 in 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. A further long-term build, 7.23.5, is dated September 4 on MikroTik's changelog, and Security Affairs lists 7.23.5 rather than 7.23.4 as the patched long-term version. The sources disagree, so take the highest build available on your branch.

We are behind a firewall. Are we safe?

Only if the firewall actually blocks inbound access to the router's SSH and web management ports, which is not a safe assumption when the router frequently is the firewall. The condition that matters is whether SSH answers from the public internet. Test it rather than assume it. A port-forwarding rule added for a one-time remote support session is a recurring finding on a first network review.

Will disabling SSH break anything in the plant?

It can, which is why the order matters. Anyone who administers that router remotely loses access the moment you close the public path, so establish local or VPN access first. Check what else the device carries, scanners, phones, badge readers or WMS traffic, and make the change outside production hours.

Our router is old and we plan to replace it. Do we still patch?

Yes, today. A replacement plan is not a control. If the device is in service and reachable, it is either patched or closed off from the internet. A purchase order for next quarter changes nothing about this week.

If we find the indicators, what does recovery look like?

Isolate the device, preserve its logs and configuration for whoever investigates, factory reset, then reconfigure from a trusted backup rather than from what was on the box. Review the rest of the network too, because a router with an attacker on it may have been the route to other systems, and rotate any credentials that crossed it.