Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

Unauthenticated Takeover Over SSH

CERT Polska has issued a warning that attackers are actively exploiting internet-exposed SSH services on MikroTik RouterOS devices to gain full administrative control — without needing to authenticate at all. According to the September 5 advisory, successful attacks have been observed dating back to at least September 2, 2026.

CERT Polska is tracking the attack chain under the name "MikroTick," describing it as a combination of two flaws in RouterOS's SSH handling. The agency has not yet published the specific CVE identifiers or the full technical exploit chain, but has confirmed that the combination allows a remote, unauthenticated attacker to obtain administrator-level access to the router.

Affected Versions

Any MikroTik device running RouterOS within these ranges with SSH reachable from the internet should be considered at risk until patched.

Why This Matters

MikroTik routers are widely deployed by ISPs, small businesses, and prosumers, and are frequently left with management interfaces — including SSH — exposed directly to the internet for remote administration. A pre-authentication path to full admin control on a router is a high-value target for attackers: routers sit at the network edge, see all traffic passing through them, and are a common building block for large-scale DDoS botnets, traffic-interception operations, and further network compromise.

MikroTik devices in particular have a long history of being recruited into botnets (including past campaigns tied to large-scale credential theft and DNS hijacking) precisely because so many units remain internet-facing and unpatched for extended periods.

Recommended Actions

1. Patch immediately to RouterOS 6.49.21, 7.23.5, or 7.24.2 depending on your branch.
2. Disable SSH access from the WAN interface — restrict management access to a trusted LAN, VPN, or bastion host.
3. Audit user accounts on any internet-exposed device for unauthorized additions.
4. Review device configuration for unexpected firewall rule changes, new scheduled scripts, or altered NAT/routing rules that could indicate persistence.
5. Check logs for SSH connection attempts and successful logins from unfamiliar source IPs around or after September 2, 2026.

Sources

• The Hacker News — Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication