CERT Polska Warns of Active Attacks Targeting Exposed MikroTik Router Services

CERT Polska has warned that attackers are actively targeting MikroTik routers whose remote-management services are accessible from the internet. The activity, observed from at least September 2, can reportedly give intruders administrative control of affected devices without valid credentials.

The national incident response team said the attacks involve a combination of two vulnerabilities it refers to as “MikroTrick.” Public advisories did not identify the individual flaws in the chain or provide details on how they are combined. Neither CERT Polska nor MikroTik had publicly attributed the activity or disclosed the number of potentially affected systems at the time of the warning.

RouterOS versions and updates

MikroTik has released security updates for affected RouterOS versions. Administrators should obtain updates only from official MikroTik channels and apply the appropriate release for their deployment.

• RouterOS 6 installations from version 6.0.0 through versions below 6.49.21 should update to 6.49.21 or later.
• RouterOS 7 installations from version 7.0.0 through versions below 7.23.4 require an update; version 7.23.5 is recommended for the long-term channel.
• Stable-channel systems from 7.24 through versions below 7.24.2 should move to 7.24.2 or later.
• The development-channel fix was included in RouterOS 7.25beta3.

MikroTik said version 7.23.5 also addresses an IPv6 DHCP regression introduced in 7.23.4 while retaining the relevant security corrections.

Mitigation and compromise checks

Until patches can be installed, CERT Polska recommends disabling externally exposed services or limiting them to trusted administration networks. The advice specifically covers SSH, web management services, and bandwidth-test access. Organizations should also avoid initiating TLS connections or using RouterOS’s built-in SSH client from unpatched routers.

After updating, administrators should review logs and configurations for unauthorized users, scripts, or other unfamiliar changes. CERT Polska highlighted unexpected privileged accounts named ops and account-creation log entries containing ssh:-2@ as indicators that warrant investigation. RouterOS devices may also enter a flagged state when startup checks identify suspicious configuration entries.

If compromise is suspected, responders should isolate the router, preserve logs and configuration evidence, reset it to factory settings, and rebuild it from a known-good configuration. Full backups from a potentially compromised device should not be restored without careful review. Passwords, keys, and other credentials associated with the router should also be replaced.