Hackers Are Taking Over MikroTik Routers Left Open on the Internet

Key points

• Poland's national cyber response team CERT Polska published a warning on 5 September about active attacks on MikroTik routers.
• The hackers are reaching the routers through SSH, a remote-access service, that owners have left open to the wider internet.
• Successful break-ins date to at least 2 September, with attackers gaining full administrator control without a password.
• No victim count, specific router model list, or attacker identity has been made public.
• Owners are urged to close SSH to the internet, restrict it to trusted addresses, and check devices for unfamiliar accounts.

Someone is quietly taking over MikroTik routers, the small networking boxes that sit in offices and homes across Europe, and the warning is coming from Poland's national cyber team.

On 5 September, CERT Polska issued an alert that attackers are breaking into MikroTik devices through SSH, short for Secure Shell, the remote-access service administrators use to manage a router remotely. They're getting in without a password. We first covered CERT Polska's active-exploitation warnings on 20 August, and the pattern is consistent: the agency moves fast when it sees real traffic against Polish infrastructure.

Full administrator control. No login required.

What is actually happening?

Criminals are scanning the internet for MikroTik routers whose SSH port has been left open to anyone, then using that opening to seize the device. Successful attacks date to at least 2 September, according to CERT Polska.

Think of SSH as a side door meant for the building's maintenance staff. Leave it unlocked and facing the street, and someone who isn't maintenance will eventually try the handle. Here, they're walking straight through.

Once inside, an attacker has the same powers as the router's owner: they can watch traffic, redirect visitors to fake websites, use the router as a launchpad for further attacks, or park malicious software on it quietly. It's almost identical to what we reported on 28 May, when GRU operators hijacked 18,000 SOHO routers for DNS rewriting, though attribution here remains open.

Who is affected and how many?

We don't know yet. As The Hacker News noted in its 6 September write-up, the Polish advisory doesn't publish a victim count, a list of affected router models, or the name of the group behind the attacks.

MikroTik routers are popular with internet providers, small businesses and home users who manage their own kit, especially across Europe. Any of those groups could be in scope.

What should router owners do?

Stop exposing SSH to the open internet. That single change closes the door the attackers are using.

CERT Polska's practical advice covers four steps:

If you rent your router from an internet provider, ask them whether SSH is exposed on your device and whether they've applied the latest RouterOS update.

Would multi-factor authentication have helped?

Probably not on its own. The attacks appear to bypass the login step entirely rather than guessing or stealing passwords, so an extra code from a phone would never have been requested. The fix is network hygiene: don't expose management interfaces to the internet at all, and if you must, put them behind a VPN, a private tunnel that keeps the service off public scanners.

This is authentication being sidestepped, not defeated. The strongest login in the world doesn't help if attackers never have to use it.

CERT Polska says it'll publish more technical detail as its investigation continues. Close the door now.