# Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

> **Open Intelligence Dossier** · First detected: 2026-09-07 14:07 UTC · Category: Business

## Executive Summary
Attackers are bypassing authentication to hijack MikroTik routers via internet-exposed SSH, granting them complete control over targeted networks.

## Intelligence Brief
A critical security vulnerability in MikroTik RouterOS is being exploited by hackers to gain unauthorized access to network hardware. According to reports from The Hacker News, attackers are hijacking routers specifically through SSH services that are exposed to the internet. This exploit allows for hijacking without the need for authentication, effectively bypassing standard security gates. The primary objective of these attacks appears to be gaining complete network access, as detailed by CyberSecurityNews, which puts the entire internal infrastructure of the affected organization at risk. Multiple cybersecurity outlets are monitoring the situation, with Cybernews reporting that RouterOS flaws have put exposed routers at risk.


CERT Polska has also issued notifications regarding these vulnerabilities in the MikroTik RouterOS software. A key technical indicator identified by Security Affairs is the presence of a specific SSH user named "-2". The outlet warns that the appearance of this particular user account may indicate that a MikroTik router has already been compromised by the threat actors leveraging this vulnerability. This trend is significant because MikroTik hardware is widely used in business and home networking environments. The ability for an external attacker to enter a network without authentication represents a severe failure of the perimeter defense.


Because the SSH service is the primary method for remote management, its exploitation provides a direct path for attackers to manipulate network traffic, steal data, or deploy further malware within a network. The coverage emphasizes that any router with SSH open to the public internet is a potential target for these in-the-wild attacks. Users and network administrators are encouraged to check their systems for the signature "-2" SSH user to determine if a breach has occurred. Future developments will depend on the dissemination of patches and the adoption of secure configurations to close internet-exposed SSH ports. Coverage does not yet specify the exact version numbers of RouterOS affected or the specific CVE identifiers, but the current focus remains on identifying compromised devices and mitigating the risk of total network takeover via the RouterOS flaws.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Cybernews | MikroTik RouterOS flaws put exposed routers at risk | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE9RdmtEbmE2cmJEeTdqanE4cTl6aEowNmROMnV0WFBVTzJ5MEVGYVI1V1RsQlQzMTZDYU5WMTVWODBoWnFqNGNKLUU1djFBSDhRdmU1dUIycThFMXMzMGpGRVdBei01ak5Za3JlMldCX2xhSUVaYzJNNUNuVmdTR0k?oc=5) |
| CyberSecurityNews | Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access | [Source Link](https://news.google.com/rss/articles/CBMib0FVX3lxTE5xZWdneG5xb1RmOFhqWV81UXNScy1JOGNSVU9NYzRETGpzUWVFSk1HTUdLVkxJQl9zRWJvblpnUUJOb0tLQnVHRHlpMDBZQXdMS0xUMml5VTcteTRzM1NnVERDdlZTOXEzWUVvNmdJTdIBdEFVX3lxTFBsT3ZhSmplQjQwNkF4d1lIWTlUX0FZRW9KdFJYeUdQMmx4WmlUejRqOW5kRUJXaS1WM2JEOUJVQ0hXNkdiXzRpa1d2SEE4WFZCelY4OXg5clFqM3ZoNDFHejFZZldYQ3c0VDlJNVhQWUFqQTRN?oc=5) |
| Security Affairs | Your MikroTik Router May Already Be Compromised: Look for SSH User “-2” | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxQYVI1eFh5Qk9QRGF6VFFfOXEzSU94d0VrbWhrd3RSYU4zdGxwTjJObE4zRFdoSzhySXFyQ1JzWWJzQWpHaTdZODJXdHAwYmYzMGJWNV9ta1JfV0k0U211VG1vbzZlaUVKd2hZNmtlNkxqNjItSmpVNThFdTNnakRsNWtVeXhyMWt1X1NTWUl3WkhsUHg2aGRSUTRUY1N5TEdhTlo4SjFvOUtCa2xnbTNxV1BJN3AwbTjSAbwBQVVfeXFMTzJMcWc2cG83Y25iTWtvdlFyandOTG9ScmFnSnVLWmFSWi13ZE5mcHdjYk1SSHp2TnBmSzMwVGxQN3c4T3UxNkpCc3R4TVVaRDRlOU1vaWU0eHQzaVE3QnBjWnY1Vm9BVmxuZnVkNzd2emVNRFNhX2lCSTBkYzJsYVdZRG40UnVoaVZPa09uODBZQk1lZEFic2RBZzV) |
| CERT Polska | Vulnerabilities in Mikrotik RouterOS software | [Source Link](https://news.google.com/rss/articles/CBMiZkFVX3lxTE9FT1cyQmtYX1Juc09qeFN6TXh4RWRaR2tpYmcyRTFTZ2JBdlFObDdKNWxrQUFoNlhraEVCcW5lU1VRLXBYeHI2UmYxWVJ0QU16THhiRkVlSHltRXFTQmE0TC0zNHVnZw?oc=5) |
| The Hacker News | Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE42OURKSS1Dd3Nfam5KTnIzODREY25SR1VZN2RxMGl5ckhqYm0wdWxxSjB5Y3dEMkNHdUdrQ3NKUWlvVUZIdW0wWk9HRmg3bXdTR1ZvNHNPV0Nra1cwT1lLenQwcTFrVEtCUGxjNG5uYmhSY0Fpak1HZ2tfRU4?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-09-07/attackers-hijack-mikrotik-routers-through-internet-exposed-ssh-without*