Threat actors are leveraging vulnerabilities in **MikroTik** routers, specifically targeting devices with publicly accessible Secure Shell (SSH) remote-access services, to achieve unauthenticated administrative control. This concerning development was highlighted by **CERT Polska** in an attack warning published on September 5th, with successful exploitation dating back to at least September 2nd. While the exact number of affected victims and the identity of the attackers remain undisclosed, the severity of the attacks necessitates immediate attention from network administrators and privacy-conscious users.  ## Urgent Security Updates Released **MikroTik** has released security updates for its **RouterOS** to address these vulnerabilities. **CERT Polska** strongly recommends immediate installation of these fixes, followed by a thorough check for any unauthorized configuration changes that may indicate a compromise. For home **MikroTik** devices, the vendor's default firewall explanation states that public access to management ports is blocked as long as the default firewall rules are intact. However, devices with modified or exposed configurations are at significant risk. ## Affected Versions and Update Guidance IT security professionals should refer to the official **RouterOS** downloads for their specific updates. The following table outlines the affected **RouterOS** versions and their corresponding security fixes: | Affected range reported by CERT | Initial security fix | Update guidance | |---|---|---| | From 6.0.0 below 6.49.21 | 6.49.21 | RouterOS 6 security release | | From 7.0.0 below 7.23.4 | 7.23.4 | Use 7.23.5 on the long-term channel | | From 7.24 below 7.24.2 | 7.24.2 | Stable channel security release | | No development range listed in CERT’s disclosure | 7.25beta3 | Development channel fix | It's worth noting that the **7.23.5** regression fix addresses an **IPv6 DHCP** (Dynamic Host Configuration Protocol) issue introduced in **7.23.4** while retaining the critical security update. ## Interim Mitigation Strategies Until the necessary updates can be installed, **CERT Polska** advises several temporary mitigation steps. These include disabling exposed services or restricting access to trusted management networks, particularly for **SSH**, **WWW/WWW-SSL**, and bandwidth-test services. Furthermore, it is recommended to avoid initiating **Transport Layer Security (TLS)** connections or using **RouterOS's** built-in **SSH** clients from an unpatched device. These temporary restrictions are designed to cover a broader set of potential vulnerabilities and do not negate the importance of installing the official updates. ## Post-Update Verification and Compromise Detection After applying the updates, administrators should check system logs and run `/system/device-mode/print` to inspect the device's status. **MikroTik's** **Flagged status guidance** indicates that **RouterOS** flags a device when startup checks detect suspicious configurations, disabling those entries and restricting certain functions. Even without a warning, it is crucial to thoroughly inspect the configuration for unknown users, unauthorized scripts, and any other unrecognized changes. **CERT Polska** specifically points to unexpected highly privileged `ops` accounts and account-creation logs containing `ssh:-2@` as strong indicators of potential compromise. ## Recovery Steps for Compromised Devices Should the warning, logs, or configuration suggest a compromise, **CERT Polska** recommends the following recovery steps. It is vital not to clear the **Flagged** status before preserving evidence and completing a full analysis: 1. **Isolate and Preserve**: Immediately isolate the router from the network. Preserve its logs and configuration before initiating any reset. **CERT Polska's** preservation guide (available in Polish) provides instructions on how to export and download these critical files. 2. **Restore and Rebuild**: Restore factory settings and rebuild the configuration using a trusted, verified baseline. Avoid blindly restoring a full backup from a potentially compromised device, as this could reintroduce malicious elements. 3. **Change Credentials**: Change all passwords, keys, and other secrets that were in use on the device. **CERT Polska** refers to the observed attack chain as **MikroTrick**, a combination of two undisclosed flaws that grant administrative control. The precise nature of these vulnerabilities and how they combine remains unspecified in public disclosures. The timeline of the initial fixes and attack observations does not definitively establish whether a public fix was available before the attacks commenced, leaving the zero-day status of these exploits unverified. Ghost Protocol has reached out to **CERT Polska** and **MikroTik** for further comment.