Hackers Are Taking Over MikroTik Routers Through a Chained Attack Called MikroTrick
Two critical flaws in MikroTik's RouterOS software are being actively exploited together to seize full control of internet-facing routers. More than 120,000 devices are exposed. Patches are available now.
Key points
- Attackers have been chaining two critical MikroTik RouterOS flaws, dubbed MikroTrick, since at least September 2 to take full control of exposed routers.
- The Shadowserver Foundation counted more than 120,000 MikroTik devices with their SSH port open to the internet during a scan on September 5.
- CERT Poland confirmed that compromised devices show a rogue account named 'ops' and attacks traced to two specific IP addresses.
- MikroTik has patched six vulnerabilities in RouterOS; affected users should update immediately to versions 7.24.2, 7.23.4, or 6.49.21.
- MikroTik says most device configurations are not at risk, but urges all users to block SSH access from untrusted sources.
MikroTik makes the small, affordable network routers used in homes, small businesses, and internet infrastructure across the world. The company, based in Latvia, is popular partly because its devices are cheap and configurable. That same reach now makes them a target.
On September 5, the Shadowserver Foundation, a nonprofit that scans the internet for vulnerable devices, found more than 120,000 MikroTik routers with their SSH service, the remote-access channel administrators use to manage devices, exposed directly to the public internet.
How did the hackers get in?
Criminals chained two critical flaws together. The first, CVE-2026-67276, scores 9.2 out of 10 on the standard severity scale and lets an attacker log into a device's SSH service without a password. SSH (Secure Shell) is a protocol that lets someone control a device remotely, as if they were sitting in front of it. The second, CVE-2026-86060, also scoring 9.2, lets that same attacker then escalate their access to the highest level of control once they are inside.
CERT Poland, the national cybersecurity authority, confirmed this combination is being actively used. Attacks began on or before September 2. Both came from two specific IP addresses: 82.192.72.4 and 103.102.31.18.
A third flaw being tracked alongside them, CVE-2026-67277 (severity score 8.8), can cause a device to crash or leak memory contents, meaning fragments of data held in the device's working memory that could include sensitive information.
| CVE ID | Severity score | What it lets attackers do |
|---|---|---|
| CVE-2026-67276 | 9.2 | Bypass SSH login entirely |
| CVE-2026-86060 | 9.2 | Gain full administrator control |
| CVE-2026-67277 | 8.8 | Crash the device or extract memory data |
| CVE-2026-67278 | Not disclosed | Impersonate a trusted server |
| CVE-2026-67279 | Not disclosed | Tamper with configuration files without logging in |
| CVE-2026-67281 | Not disclosed | Read protected system files |
The three remaining flaws patched in this update, CVE-2026-67278, CVE-2026-67279, and CVE-2026-67281, are serious in their own right. They allow impersonation of trusted servers, silent tampering with configuration files, and reading of protected system files.
Should router owners be worried?
If your MikroTik router's SSH port is not exposed to the internet, your immediate risk is lower. MikroTik itself says most configurations are not at risk. But 120,000 devices are, and the attack has already started.
CERT Poland says a hacked device will have a new user account called 'ops' that the owner never created. MikroTik adds that compromised devices will show a 'Flagged' entry in the device's log section. Neither sign should be ignored.
Patched versions are RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Update through the MikroTik Winbox management tool or the device's web interface. Block SSH access from any address you do not recognise and trust.
For ordinary people at home or in small offices whose internet comes through a MikroTik device: check with whoever set up your router. If they do not know whether SSH is open to the internet, assume it might be and ask them to patch it today.
