Hackers Are Taking Over MikroTik Routers Left Open on the Internet

Key points

• Poland's national cyber response team CERT Polska published a warning on 5 September about active attacks on MikroTik routers.
• The hackers are reaching the routers through SSH, a remote-access service, that owners have left open to the wider internet.
• Successful break-ins go back to at least 2 September, with attackers gaining full administrator control.
• No victim count, specific router model list, or attacker identity has been made public.
• Owners are urged to close SSH to the internet, restrict it to trusted addresses, and check devices for unfamiliar accounts.

Someone is quietly taking over MikroTik routers, the small networking boxes that sit in offices, shops and homes across Europe, and the warning is coming from Poland's national cyber team.

On 5 September, CERT Polska issued an alert that attackers are breaking into MikroTik devices through SSH, short for Secure Shell, which is the remote-access service network administrators use to log in and manage a router from somewhere else. The attackers are getting in without needing a password.

That is the part that should make owners sit up. Full administrator control. No login required.

What is actually happening?

Criminals are scanning the internet for MikroTik routers whose SSH port has been left open to anyone, then using that opening to seize the device. Successful attacks date back to at least 2 September, according to CERT Polska.

Think of SSH as a side door meant for the building's maintenance staff. If you leave that door unlocked and facing the street, eventually someone who is not maintenance staff will try the handle. In this case they are walking straight through.

Once inside, an attacker has the same powers as the router's owner: they can watch traffic, redirect visitors to fake websites, use the router as a launchpad for further attacks, or quietly park malicious software on it for later.

Who is affected and how many?

The honest answer is that we do not know yet. As The Hacker News noted in its 6 September write-up, the Polish advisory does not publish a victim count, a list of affected router models, or the name of the group behind the attacks.

MikroTik routers are popular with internet providers, small businesses and technically minded home users, especially across Europe. Any of those groups could be in scope.

What should router owners do?

Stop exposing SSH to the open internet. That single change closes the door the attackers are walking through.

CERT Polska's practical advice boils down to a few steps:

If you rent your router from an internet provider, ring them and ask whether SSH is exposed on your device, and whether they have applied the latest RouterOS update.

Would multi-factor authentication have helped?

Honestly, in this case, probably not on its own. The attacks appear to bypass the login step entirely rather than guessing or stealing passwords, so an extra code from a phone would never have been requested. The fix here is network hygiene: do not expose management interfaces to the internet at all, and if you must, put them behind a VPN, a private tunnel that hides the service from public scanners.

This is authentication being sidestepped, not defeated. It is a reminder that the strongest login in the world does not help if attackers never have to use it.

CERT Polska says it will publish more technical detail as its investigation continues. For now, the sensible move is simple. Close the door.