Hackers Are Taking Over MikroTik Routers Through a Chained Attack Called MikroTrick
Two critical flaws in MikroTik's RouterOS software are being actively exploited together to seize full control of internet-facing routers. More than 120,000 devices are exposed. Patches are available now.
Key points
- Attackers have been chaining two critical MikroTik RouterOS flaws, dubbed MikroTrick, since at least September 2 to take full control of exposed routers.
- The Shadowserver Foundation counted more than 120,000 MikroTik devices with their SSH port open to the internet during a scan on September 5.
- CERT Poland confirmed that compromised devices show a rogue account named 'ops' and that attacks traced to two specific IP addresses.
- MikroTik has patched six vulnerabilities in RouterOS; affected users should update to versions 7.24.2, 7.23.4, or 6.49.21.
- MikroTik says most device configurations aren't at risk, but urges all users to block SSH access from untrusted sources.
MikroTik makes the small, affordable network routers found in homes, small businesses, and internet infrastructure worldwide. The Latvian company's devices are popular because they're cheap and configurable. That reach now makes them a target.
On September 5, the Shadowserver Foundation, a nonprofit that scans the internet for vulnerable devices, found more than 120,000 MikroTik routers with their SSH service exposed directly to the public internet. SSH (Secure Shell) is a protocol that lets someone control a device remotely, as if sitting in front of it. We reported on the exposure two days earlier, when CERT Poland first warned that criminals were seizing full control through that same open service.
How did the hackers get in?
Criminals chained two critical flaws together. The first, CVE-2026-67276, scores 9.2 out of 10 on the standard severity scale and lets an attacker log into a device's SSH service without a password. The second, CVE-2026-86060, also scoring 9.2, lets that attacker escalate to the highest level of control once inside.
CERT Poland, Poland's national cybersecurity authority, confirmed this combination is being actively used. Attacks began on or before September 2, originating from two specific IP addresses: 82.192.72.4 and 103.102.31.18.
A third flaw tracked alongside them, CVE-2026-67277 (severity score 8.8), can crash a device or leak memory contents, meaning fragments of data the device holds in working memory that could include sensitive information.
| CVE ID | Severity score | What it lets attackers do |
|---|---|---|
| CVE-2026-67276 | 9.2 | Bypass SSH login entirely |
| CVE-2026-86060 | 9.2 | Gain full administrator control |
| CVE-2026-67277 | 8.8 | Crash the device or extract memory data |
| CVE-2026-67278 | Not disclosed | Impersonate a trusted server |
| CVE-2026-67279 | Not disclosed | Tamper with configuration files without logging in |
| CVE-2026-67281 | Not disclosed | Read protected system files |
The three remaining patched flaws, CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281, allow impersonation of trusted servers, silent tampering with configuration files, and reading of protected system files.
Should router owners be worried?
If your MikroTik router's SSH port isn't exposed to the internet, your immediate risk is lower. Six vulnerabilities patched in one release is a meaningful cluster regardless, and the active exploitation makes delay costly.
CERT Poland says a hacked device will have a new user account called 'ops' that the owner never created. MikroTik adds that compromised devices will show a 'Flagged' entry in the log section. CERT Poland notes that the absence of either sign doesn't rule out unauthorized activity.
Patched versions are RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Update through the MikroTik Winbox management tool or the device's web interface. Block SSH access from any address you don't recognise and trust.
For people at home or in small offices whose internet runs through a MikroTik device: check with whoever set up your router. If they don't know whether SSH is open to the internet, assume it might be and ask them to patch it today.
