MikroTrick Exploit: Hackers Are Hijacking MikroTik Routers

MikroTrick is a newly disclosed attack chain targeting MikroTik RouterOS, and attackers are using it against routers that expose SSH to public networks. Under the right conditions, the flaws can give an attacker administrator control without the normal authentication process. More than 122,000 MikroTik devices were seen exposing SSH online. That does not mean they are all vulnerable or hacked, but it shows the size of the target pool.

How the MikroTrick Exploit Works

MikroTrick is the name CERT Polska gave to an exploit chain that combines two critical RouterOS flaws. CVE-2026–67276 affects SSH public-key authentication because RouterOS did not compare the entire RSA public key assigned to an authorized user. CERT Polska says an attacker who knows the username and the public modulus of that user's key can craft a different key and log in without the legitimate private key.

CVE-2026–86060 involves specially crafted usernames during SSH login and can raise a session to full administrator privileges. Both flaws received CVSS scores of 9.2. Used together, they can let an unauthenticated attacker take full control of a vulnerable router whose SSH service is reachable from a public network.

CERT Polska has confirmed real-world attacks and says MikroTik's patches stop the activity it observed. Its MikroTrick security advisory also makes an important point: not every MikroTik router online is automatically vulnerable. The confirmed attack path requires vulnerable RouterOS software and reachable SSH, while MikroTik says its default configuration blocks SSH from the public internet.

Why 122,500 Exposed Routers Matter

On September 7, BleepingComputer reported that Shadowserver Foundation data showed about 122,500 MikroTik devices exposing SSH to the internet as of September 5. That is not a count of hacked routers, and it does not prove every exposed device is vulnerable. Some may already be patched or may not meet the conditions needed for MikroTrick to work.

Even so, the reported MikroTik SSH exposure matters because attackers can scan large parts of the internet for open services and focus on systems that answer. A large pool of reachable management interfaces gives them plenty of systems to test.

Routers often stay in service for years while nobody checks their firmware or remote-access settings. That makes them different from phones, browsers, and computers that regularly push visible update reminders. A router can quietly become outdated without anyone noticing.

A Hacked Router May Still Look Normal

A compromised router does not have to crash, drop Wi-Fi, or make the internet noticeably slower. Staying quiet may be more useful to an attacker because a working network attracts less attention. Websites still load, and there may be no obvious reason to inspect the router.

With full administrator control, an intruder may be able to change accounts, firewall rules, scripts, scheduled tasks, tunnels, proxy settings, DNS settings, or other parts of the configuration. Because it handles traffic for the devices behind it, that position can be valuable even when no laptop or phone shows obvious trouble.

JENI Systems has covered a related problem in its article on how an old router can become criminal proxy infrastructure. MikroTrick is a different attack, but the broader lesson is similar: a router can look healthy while something unwanted is happening behind the scenes.

Who Is Most at Risk From MikroTrick?

The highest-priority group is anyone running MikroTik RouterOS with SSH reachable from the public internet or another untrusted network. CERT Polska lists vulnerable ranges as RouterOS 6.0.0 through versions below 6.49.21, RouterOS 7.0.0 through versions below 7.23.4, and RouterOS 7.24 through versions below 7.24.2.

The first fixed releases were 6.49.21, 7.23.4, 7.24.2, and 7.25beta3. MikroTik then released 7.23.5 on the long-term channel after fixing an IPv6 DHCP problem introduced in 7.23.4. Administrators should install the current patched release for their device and update channel.

MikroTik's September 2026 security bulletin recommends keeping SSH closed to untrusted networks and using a strong VPN such as WireGuard for remote administration instead of exposing management ports directly. Home users on the default configuration face less immediate exposure, but MikroTik still recommends upgrading. Businesses and remote environments deserve closer review because custom remote-access rules are more common there.

What MikroTik Users Should Do First

Patch the router, reduce unnecessary exposure, then inspect the device for signs that someone may have changed it before the update was installed. A fixed version closes the attack path CERT Polska observed, but it does not prove the router was clean beforehand.

Prioritize these steps:

• Install the current patched RouterOS release for the device and update channel.
• Remove public exposure of SSH and other management services unless there is a clear operational need.
• Limit remote administration to trusted networks or a properly configured VPN.
• Review users, scripts, scheduled tasks, tunnels, proxy settings, DNS settings, and firewall rules for changes you do not recognize.
• Check RouterOS logs and the Flagged status, but do not treat the absence of a warning as proof that the router was never compromised.
• If compromise is suspected, isolate the router, preserve logs and configuration, reset it to factory settings, rebuild from a trusted configuration, and rotate passwords, keys, and other secrets.

CERT Polska also warns against blindly restoring a full backup from a router that may have been compromised. If patching cannot happen right away, exposed SSH, WWW/WWW-SSL, and bandwidth-test services should be restricted or disabled. JENI Systems' router security checklist gives home users and small offices a useful starting point for firmware, remote management, port forwarding, passwords, and support status.

AI Is Speeding Up Vulnerability Research

CERT Polska says its researchers used GPT-5.5-cyber and GPT-5.6-sol while studying RouterOS in an isolated lab through OpenAI's Government and Trust Agency Collaboration program. The models helped compare RouterOS versions, analyze protocols and binary code, test ideas, and build scripts used during the research.

People still had to direct the work. Researchers designed the lab, tested findings on real RouterOS systems, ran negative controls, rejected false conclusions, and judged the real impact. This was not a chatbot receiving one clever prompt and suddenly finding a router takeover.

What changed was speed. OpenAI's Daybreak cyber defense program describes frontier models being used for authorized defensive work such as vulnerability discovery and patch validation. Once a patch becomes public, researchers can compare fixed and older software to understand what changed. Attackers can try the same thing, so that window may keep shrinking.

Why Router Security Deserves More Attention

MikroTrick will eventually leave the headlines, but the larger problem will not. Most people know they should update Windows, macOS, browsers, and phones. Routers get much less attention even though every device on the network depends on them.

A router has an operating system, administrator accounts, services, firewall rules, logs, security flaws, update channels, and a support life. The lesson is simple: know what router you use, make sure it is still supported, keep its software current, and avoid exposing management interfaces to the public internet unless there is a real reason. CISA's internet exposure reduction recommendations support the same basics, including timely patching, replacing unsupported devices, controlling administrative access, and routinely reviewing internet-facing systems.

When a router flaw is already being exploited, installing the patch should be followed by a careful inspection. Do not assume an update removes changes that may have happened earlier. The box in the closet may be easy to forget, but it controls the connection everything else depends on.