Cybersecurity researchers are sounding the alarm over a new exploit chain, dubbed **MikroTrick**, actively targeting **MikroTik** routers. This sophisticated attack leverages two recently disclosed vulnerabilities within **MikroTik RouterOS** to gain full control over devices with SSH services exposed to the internet. ### The MikroTrick Exploit Chain At the heart of the **MikroTrick** attack are two critical flaws: * **CVE-2026-67276**: An SSH authentication bypass vulnerability stemming from incomplete validation of RSA public keys. This allows an attacker, knowing a username and the public modulus of that user's key, to craft a different key and log in without the legitimate private key. * **CVE-2026-86060**: An SSH privilege escalation flaw, exploited through improper handling of specially crafted usernames. Attackers can manipulate the SSH session to obtain full administrative privileges. These vulnerabilities were discovered by **Poland's CERT** with assistance from AI models **GPT-5.5-cyber** and **GPT-5.6-sol**, both receiving a critical severity rating. ### Active Exploitation and Third Vulnerability **Poland's CERT** has issued a stark warning, confirming that these vulnerabilities are actively being exploited in the wild. "In recent days we have been observing attacks against **RouterOS** devices accessible from the internet," the agency stated. "We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks." The agency also highlighted a third flaw, **CVE-2026-67277**, affecting the **RouterOS** bandwidth-test service. This vulnerability allows unauthenticated attackers to leak kernel memory or remotely crash/restart the router. ### Vendor Response and Mitigation **MikroTik** has addressed these vulnerabilities in **RouterOS** versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, released on September 3. **Poland's CERT** has validated these fixes. While not all configurations are affected, **MikroTik** has withheld specific details to allow users time to apply the necessary security updates. Crucially, these updates introduce a compromise-detection mechanism. This feature monitors for signs of unauthorized configuration changes at startup, disables malicious entries, and logs critical warnings. However, **Poland's CERT** cautions that the absence of a compromise marker does not guarantee a router hasn't been breached. ### Indicators of Compromise (IoCs) Organizations suspecting a compromise should look for the following IoCs: * Log entries: `login failure for user -2 from <ip> via ssh` and `user <name> added by ssh:-2@<ip>` * Presence of a highly privileged ops account * IP address `82.192.72.4` (linked to confirmed successful attacks) * IP address `103.102.31.18` (observed attempting to exploit **MikroTrick**) ### Recommendations for Users If a compromise is suspected, **Poland's CERT** advises the following steps: 1. Isolate the router immediately. 2. Preserve logs and configuration for forensic analysis. 3. Perform a factory reset of the device. 4. Rebuild the configuration from a trusted source. 5. Rotate all passwords, keys, and other secrets. For those unable to apply updates immediately, it is strongly recommended to restrict or disable externally accessible SSH, WWW/WWW-SSL, and bandwidth-test services. Additionally, users should avoid the built-in SSH clients and outbound TLS connections over untrusted networks. As of September 5, **The ShadowServer Foundation** reported a significant number of **MikroTik** devices with exposed SSH interfaces, underscoring the urgency of these updates and mitigation strategies.