Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

A critical security vulnerability in MikroTik RouterOS is being exploited by hackers to gain unauthorized access to network hardware. According to reports from The Hacker News, attackers are hijacking routers specifically through SSH services that are exposed to the internet. This exploit allows for hijacking without the need for authentication, effectively bypassing standard security gates. The primary objective of these attacks appears to be gaining complete network access, as detailed by CyberSecurityNews, which puts the entire internal infrastructure of the affected organization at risk. Multiple cybersecurity outlets are monitoring the situation, with Cybernews reporting that RouterOS flaws have put exposed routers at risk.

CERT Polska has also issued notifications regarding these vulnerabilities in the MikroTik RouterOS software. A key technical indicator identified by Security Affairs is the presence of a specific SSH user named "-2". The outlet warns that the appearance of this particular user account may indicate that a MikroTik router has already been compromised by the threat actors leveraging this vulnerability. This trend is significant because MikroTik hardware is widely used in business and home networking environments. The ability for an external attacker to enter a network without authentication represents a severe failure of the perimeter defense.

Because the SSH service is the primary method for remote management, its exploitation provides a direct path for attackers to manipulate network traffic, steal data, or deploy further malware within a network. The coverage emphasizes that any router with SSH open to the public internet is a potential target for these in-the-wild attacks. Users and network administrators are encouraged to check their systems for the signature "-2" SSH user to determine if a breach has occurred. Future developments will depend on the dissemination of patches and the adoption of secure configurations to close internet-exposed SSH ports. Coverage does not yet specify the exact version numbers of RouterOS affected or the specific CVE identifiers, but the current focus remains on identifying compromised devices and mitigating the risk of total network takeover via the RouterOS flaws.