MikroTrick is the name given to a two-bug exploit chain against MikroTik RouterOS, the operating system that runs on millions of internet-facing routers, wireless access points and small-office firewalls. Chaining CVE-2026-67279 (an SSH state-machine flaw) with CVE-2026-86060 (an argument-injection privilege escalation), an unauthenticated attacker reaches full administrative control over SSH with no password, no key and no completed login.
CERT Polska (CERT.pl) disclosed the underlying cluster of RouterOS SSH bugs on September 5, 2026, but its telemetry shows exploitation began on September 2, 2026 — a day before MikroTik shipped fixes. CISA has added the chain's components to the Known Exploited Vulnerabilities catalog, and Bishop Fox independently reproduced the full takeover and found routers already carrying attacker persistence in the field.
If you run RouterOS below 6.49.21, 7.23.4 or 7.24.2 with SSH reachable from untrusted networks, treat the device as potentially compromised. Patching stops new intrusions but does not evict a foothold that already exists.
◈ Table of Contents
01 · Campaign Profile
MIKROTRICKMikroTrick is not a malware family or a named actor — it is an exploitation technique against RouterOS's SSH implementation that has been picked up and weaponised in the wild. Attribution is currently open; the activity has the fingerprint of an initial-access operation building router botnet capacity rather than a single espionage crew.
| Attribute | Detail |
|---|---|
| Chain name | MikroTrick (RouterOS SSH takeover chain) |
| Core CVEs | CVE-2026-67279 (access) + CVE-2026-86060 (privilege escalation) |
| Disclosed by | CERT Polska (CERT.pl) — cluster of RouterOS SSH bugs, 2026-09-05 |
| Independent analysis | Bishop Fox (full-takeover reproduction + field persistence findings) |
| Attribution | Unattributed (low confidence). Behaviour consistent with an initial-access / botnet operation |
| First observed | 2026-09-02 (CERT.pl attack logs) — pre-patch |
| Target | Internet-reachable MikroTik RouterOS with SSH exposed to untrusted networks |
| Outcome | Full administrative console access; persistent, self-healing admin accounts; config exfiltration |
| Status | Actively exploited · CISA KEV-listed · patched 2026-09-03 |
MikroTik hardware sits in a uniquely dangerous position on the network: it is the edge. A router that an attacker owns can inspect and redirect traffic, tunnel into the LAN, proxy attacks against third parties, and survive endpoint EDR entirely because there is no endpoint agent on a router. That is exactly why RouterOS has a long history of being harvested into botnets — and why an unauthenticated, no-password admin chain like MikroTrick is a five-alarm event for anyone running these devices at the perimeter.
Edge Position
RouterOS terminates WAN links and VPNs. Owning it means owning the traffic path in and out of the network.
No EDR Coverage
Routers do not run endpoint agents. Detection depends entirely on forwarded logs and configuration hygiene.
Botnet Appeal
Compromised MikroTik devices are historically herded into proxy and DDoS botnets — high value at scale.
02 · Disclosure & Exploitation Timeline
PRE-PATCHThe defining feature of this timeline is that exploitation preceded both the advisory and, by a day, the patch. Anyone whose devices faced the internet in early September should assume they were in scope while a fix did not yet exist.
- 12026-09-02 — Earliest public attack logs recorded by CERT.pl. A privileged account (
ops) is created remotely from82.192.72.4using the abused SSH login path. - 22026-09-03 — MikroTik publishes patched RouterOS builds (
6.49.21,7.23.4,7.24.2). - 32026-09-05 — CERT Polska publishes its advisory covering a cluster of RouterOS SSH vulnerabilities, including the two that form the MikroTrick chain.
- 4~2026-09-10 — CISA adds
CVE-2026-86060to the Known Exploited Vulnerabilities catalog on evidence of active exploitation. - 52026-09-25 — CISA adds
CVE-2026-67279to KEV with a federal remediation due date of2026-09-28under BOD 26-04. - 62026-09-26 — Bishop Fox publishes its MikroTrick deep dive, confirming full-takeover reproduction on RouterOS 7.x and documenting persistence artifacts found on live routers.
The federal KEV due date for CVE-2026-67279 is September 28, 2026 — the same day this brief publishes. If you own MikroTik devices under BOD 26-04 scope and have not patched, you are already past deadline.
03 · Affected Products & CVEs
4 CVEsCERT.pl's disclosure covered several RouterOS SSH weaknesses. Four are relevant here; two of them form the MikroTrick chain, and the other two are alternate SSH access and denial-of-service primitives an attacker can lean on. All four are confirmed in the NVD.
| CVE | CVSS (v3.1 / v4.0) | Class | Role in the story |
|---|---|---|---|
| CVE-2026-86060 | 9.8 / 9.2 Critical | Argument injection (CWE-88) | Privilege escalation — turns unauth SSH into full admin identity |
| CVE-2026-67276 | 8.1 / 9.2 High | Improper RSA key match | Alternate access — forge SSH auth by matching modulus only (7.x) |
| CVE-2026-67277 | 8.2 / 8.8 High | Related-session / bandwidth-test | Kernel memory disclosure + DoS (kernel restart) |
| CVE-2026-67279 | 6.5 / 6.9 Medium | SSH state machine | Initial access — session channel + exec before authentication |
The severity numbers are deceptive on their own. CVE-2026-67279 is "only" a medium — a session channel that should not open before login. But chained with the critical CVE-2026-86060, that medium becomes the front door to a full unauthenticated takeover. This is the classic case of chain risk dwarfing the CVSS of any single link.
| Branch | Affected range | Fixed build |
|---|---|---|
| 6.x (Long-term) | 6.0.0 – 6.49.20 | 6.49.21 |
| 7.x (Long-term) | 7.0.0 – 7.23.3 | 7.23.4 |
| 7.x (Stable) | 7.24.0 – 7.24.1 | 7.24.2 |
| 7.x (Development) | prior to 7.25 beta 3 | 7.25 beta 3 |
The full MikroTrick chain lands on 7.x systems. On 6.x, CVE-2026-67279 still gives an unauthenticated session channel, so 6.x devices are not safe — they are exposed to the access and DoS primitives even if the full 7.x privilege path differs.
04 · Initial Access — CVE-2026-67279
SSH REKEYSSH is a state machine. A client is supposed to move through key exchange, then user authentication, and only then into the "connection protocol" phase where session channels and exec requests are allowed. CVE-2026-67279 breaks that ordering.
In a vulnerable build, when a client requests a key re-exchange (rekey) — a normal, legitimate SSH operation to refresh session keys — RouterOS advances the connection into the next protocol phase even though user authentication was never attempted, let alone completed. The state check that should keep an unauthenticated client locked out of the connection protocol is simply skipped after the rekey.
- 1Open a session channel that should only be reachable post-login.
- 2Send an
execrequest against that channel — remote command execution surface, pre-auth. - 3Reach file operations in the RouterOS namespace: create, overwrite and reconstruct configuration and diagnostic files.
No password, key or credential is exchanged at any point. The vulnerability is purely in how the SSH state machine handles a client-initiated rekey before authentication.
On its own, CVE-2026-67279 is scored a medium because what an attacker can do with that channel is limited — until it is paired with a bug that decides who the attacker is. That is CVE-2026-86060.
05 · Privilege Escalation — CVE-2026-86060
ARG INJECTIONThis is the technical heart of MikroTrick, and it is an elegant, old-school argument-injection bug. The SSH service hands the client-supplied username to a helper process as a command-line argument — without sanitising it. Anything a defender learned from shell injection and getopt parsing applies directly here.
When a username starts with a prohibited character — a leading dash, e.g. -2 — the helper does not treat it as a name. It treats it as an option. In this login helper, an argument like -2 is interpreted as a file-descriptor selector, instructing the helper to read a trusted identity/policy record from file descriptor 2 — which is wired to the attacker's own session terminal.
- 1Attacker supplies the username
-2over the pre-auth session channel obtained via CVE-2026-67279. - 2The helper parses
-2as a flag and reads the "trusted" identity record from file descriptor 2. - 3Because that descriptor is attacker-controlled, the attacker supplies a record specifying an administrator identity with a full RouterOS policy mask.
- 4RouterOS installs that attacker-defined identity as a trusted, fully-privileged account — no legitimate authentication ever completed.
The RouterOS "policy mask" is the set of permission bits (read, write, policy, ftp, ssh, sensitive, etc.) attached to a user group. Controlling the mask is equivalent to controlling every capability the console offers.
CERT.pl's cluster also documented two adjacent SSH primitives worth knowing, because a resourceful operator can substitute them:
CVE-2026-67276 — RSA match flaw
RouterOS matches an SSH public key by type and modulus but omits the exponent. An attacker who knows an authorised key's modulus can forge a valid signature and open a command channel without the private key (7.x only).
CVE-2026-67277 — bandwidth-test
An unauthenticated "related" bandwidth-test session leaks uninitialised kernel buffer data and can trigger an integer underflow, restarting the kernel — memory disclosure plus a denial-of-service lever.
06 · The Full MikroTrick Chain
END-TO-ENDPut the two links together and the result is a single, unauthenticated SSH conversation that ends with the attacker holding admin. Here is the end-to-end flow.
- RouterOS build below 6.49.21 / 7.23.4 / 7.24.2 / 7.25 beta 3
- SSH service reachable from the attacker's network position
- Full-admin outcome requires the 7.x branch (CVE-2026-86060 path)
07 · Post-Exploitation & Persistence
FIELD EVIDENCEBishop Fox found real, in-the-wild persistence on compromised routers — not theoretical constructs. The tradecraft is deliberately mundane: it hides inside the router's own script and scheduler subsystems using innocuous, admin-sounding names.
A full-privilege user (observed as ops) is created via the abused login path. Deleting it is not enough — a companion script recreates it.
- 1Script named
logrotate— a name that blends into normal maintenance — recreates the full-privilege account if a defender removes it. - 2Scheduler entry named
daily-maintexecutes that script every day at03:00:00, guaranteeing the account comes back after cleanup. - 3Unauthorized accounts carry device-specific generated passwords, so a single leaked credential does not open every router.
Objects created through the abused path display their owner as the numeric identity 0 rather than a named administrator such as admin. Legitimately created objects are owned by a named user. An object owned by 0 is a high-fidelity marker that it was written outside the normal authenticated management flow.
This single behavioural marker — owner="0" on users, scripts or scheduler entries — is the fastest triage signal you have. Prioritise it over signature matching.
Investigators observed RouterOS configuration export (RIF) files being created and transferred out to attacker infrastructure — the router's entire config, including secrets, tunnels and firewall posture, handed to the operator. In several cases volatile logs were missing for the suspected compromise window while the configuration itself was preserved, consistent with an operator who understands what evidence lives where on the device.
08 · Indicators of Compromise
IOCsIOCs below are drawn from CERT.pl telemetry and Bishop Fox field analysis. Treat the network indicators as leads, not allow/deny truth — an operator rotates infrastructure freely, so the behavioural and host artifacts are more durable.
| Type | Indicator | Context |
|---|---|---|
| IP | 82.192.72.4 | Source of successful attacks incl. privileged ops account creation since ≥ 2026-09-02 |
| IP | 103.102.31.18 | Observed exploitation attempt source |
| Account | ops (full group) | Privileged account created via the abused SSH login path |
| Script | logrotate | Recreates the full-privilege account if removed |
| Scheduler | daily-maint @ 03:00:00 | Runs the persistence script daily |
| Object attr | owner="0" | Numeric owner instead of a named admin — key hunt marker |
The literal username -2 appearing in an SSH log line is not something a legitimate user or admin ever generates. Any occurrence is a direct signal of CVE-2026-86060 exploitation attempts against that device.
09 · DFIR Investigation Steps
RESPONDEROrder matters. Preserve first, then triage on the device, then decide on rebuild. Do not factory-reset before you have exported evidence — you will destroy the only record of what happened.
- 1Preserve. Export the running configuration and all available logs off-box before touching anything. Volatile logs may already be incomplete.
- 2Enumerate users. List every user and group; flag any account you cannot map to a person, especially
ops, and anything withowner="0". - 3Audit scripts & scheduler. Review
/system scriptand/system schedulerfor unfamiliar entries —logrotate,daily-maint, or anything you did not create. - 4Review reach. Inspect proxies, tunnels (IPsec, WireGuard, EoIP, L2TP), SOCKS/web-proxy config, and firewall NAT/redirect rules an attacker may have added.
- 5Hunt the log strings. Search forwarded syslog for
user -2,added by ssh:-2, and connections from the known IPs. - 6Confirm exposure. Determine whether SSH was reachable from untrusted networks during the window and on which build the device ran.
- 7Decide rebuild. If any indicator is present, isolate, factory-reset, reflash a patched build, rebuild from a verified baseline, and rotate every secret the config held.
Export config as text and grep it off-box: an attacker can hide entries from paged console output, but a full plaintext export is harder to selectively conceal. Compare against a known-good baseline diff.
10 · Detection & Hunt Queries
KQL + SPLRouters have no EDR, so detection runs on the syslog you forward from RouterOS to your SIEM. If you are not forwarding RouterOS logs today, that is the first gap to close. Each query below is paired KQL (Microsoft Sentinel) and SPL (Splunk).
| Data source | What it gives you | Priority |
|---|---|---|
| RouterOS SSH log | The user -2 and added by ssh:-2 artifacts — highest-fidelity signal | Critical |
| RouterOS system/account log | User, script and scheduler creation events (persistence) | Critical |
| Firewall / flow logs | Inbound SSH from the known source IPs; outbound RIF exfil transfers | High |
| Config-change / backup diff | New users, proxies, tunnels, NAT redirects vs known-good baseline | High |
| NetFlow / perimeter | Unexpected proxy/tunnel traffic sourced from the router (botnet tell) | Medium |
Tuning note: legitimate automation and monitoring tools log into RouterOS over SSH constantly. Filter on the -2 username and known-bad IPs first — those are near-zero false-positive signals — before you rely on the rekey-volume heuristic, which needs a per-environment baseline.
11 · MITRE ATT&CK Mapping
TTPsPrimary sources did not publish explicit ATT&CK IDs; the mapping below is CyberHawk's, aligned to the observed behaviour and the ATT&CK for Network Devices matrix.
| Tactic | Technique | ID | Where it shows up |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | SSH service on internet-facing RouterOS |
| Initial Access | External Remote Services | T1133 | Router SSH reachable from untrusted networks |
| Privilege Escalation | Exploitation for Privilege Escalation | T1068 | CVE-2026-86060 argument injection |
| Credential Access / Def. Evasion | Modify Authentication Process | T1556 | Injected policy mask / trusted identity |
| Persistence | Create Account: Local Account | T1136.001 | Privileged ops account |
| Persistence | Scheduled Task/Job | T1053 | daily-maint scheduler @ 03:00:00 |
| Defense Evasion | Indicator Removal | T1070 | Missing volatile logs for the compromise window |
| Collection | Data from Configuration Repository: Network Device Config Dump | T1602.002 | RIF config export exfiltrated to attacker IP |
| Impact | Endpoint Denial of Service | T1499 | CVE-2026-67277 kernel-restart primitive |
12 · Mitigation & Hardening
FIX + HARDENPatch first, but do not stop there. Because exploitation predated the fix, patching alone leaves any pre-existing foothold in place. Combine the upgrade with an assumed-breach review and edge-exposure reduction.
- 1Upgrade RouterOS to
6.49.21,7.23.4,7.24.2or later (dev:7.25 beta 3). - 2Remove SSH from the WAN. Restrict SSH, WWW/WWW-SSL and bandwidth-test to trusted management addresses; require a VPN for administration.
- 3Assume compromise on any exposed device that ran a vulnerable build with SSH reachable — audit before you trust it.
- 4Hunt the markers:
owner="0"objects, theopsaccount,logrotate/daily-maint, and the log strings from section 08. - 5Disable the bandwidth-test server if unused, to remove the CVE-2026-67277 disclosure/DoS surface.
- 6If compromised: preserve evidence, factory reset, reflash a patched build, rebuild from a verified baseline, and rotate every secret the config held (VPN PSKs, RADIUS, SNMP, admin creds).
- 7Forward RouterOS syslog to your SIEM so the queries in section 10 have data to run against going forward.
Do not rely on obscure ports. Moving SSH off port 22 does not mitigate MikroTrick — the flaw is in the protocol handling, not the port. Only patching plus access restriction closes it.
13 · Sources & References
VERIFYOwn MikroTik at the edge? Pull the two source IPs and the host artifacts from this brief into your monitoring, then run them through the CyberHawk IOC Scanner to check exposure across your estate. For more edge-device and active-exploitation coverage, follow the CyberHawk Threat Intel feed and browse the blog for the latest KEV breakdowns.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."