MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login

MikroTik router owners face a security problem after researchers reproduced a takeover chain that can hand an outsider full administrator control without a password.

The attack, MikroTrick, targets exposed RouterOS devices through SSH and can turn a network gateway into an attacker-controlled foothold. The risk is serious because a router handles traffic entering and leaving a home or business.

An intruder with administrative rights could change settings, create hidden accounts, intercept data, or use the device to reach systems behind it. Evidence indicates exploitation began before the flaws became public.

Bishop Fox identified the chain while examining the flaws and later found configuration artifacts consistent with real-world compromise on internet-facing devices.

Bishop Fox said in a report shared with Cyber Security News (CSN) that its testing reproduced a full takeover on vulnerable 7.x builds.

The disclosure follows reports of active MikroTik RouterOS exploitation that urged administrators to update exposed equipment. The findings add a warning: an update blocks fresh attacks, but does not remove an attacker who has already created a way back into the router.

MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers

MikroTrick combines CVE-2026-67279 and CVE-2026-86060, two weaknesses at different points in the RouterOS SSH login process. Neither needs a stolen password in testing, making internet-exposed SSH services the main concern for defenders.

The first bug appears during SSH rekeying, a routine process that refreshes encryption keys in a connection. On affected builds, a client that has not logged in can use rekeying to reach functions available only after authentication.

It can open a session channel and request command execution, although it has no valid identity yet. The second bug turns that limited foothold into full control. RouterOS sends the username supplied over SSH to a helper that assigns identity and permissions.

A value beginning with a dash can make the helper read a trusted identity record from an internal channel instead of treating it as a normal username. On vulnerable 7.x versions, researchers found that an attacker-controlled terminal can supply that record.

By providing an administrator identity and permissions, an attacker can cause the device to accept them without normal login. That is why this is more severe than a simple bypass and why unauthenticated router access risks deserve rapid attention.

The first-stage bypass also affects 6.x, but Bishop Fox did not achieve an administrative session there with the same method. The tested full takeover applies to vulnerable RouterOS 7.x builds. That distinction matters for remediation, but is no reason to leave an exposed device unpatched.

Patch, Hunt, and Recover

MikroTik addressed the six flaws covered by the September advisory in supported releases. Organizations should update the applicable branch to RouterOS 6.49.21, 7.23.4, 7.24.2, or later.

The changes prevent unauthenticated sessions from reaching protected requests and reject usernames that could invoke the helper’s special control syntax.

Patching alone is not a cleanup plan. Administrators should treat previously exposed routers as potentially compromised, then review privileged users, configuration history, remote logs, scripts, schedulers, proxies, tunnels, and the RouterOS flagged state.

The importance of checking configuration is reinforced by MikroTik botnet exposure risks, where unpatched internet-facing routers remained a target.

Bishop Fox found that RouterOS login records may vanish after a reboot because logs are stored in memory by default. However, persistence can survive.

Researchers observed a script and scheduled task that recreated a privileged account daily, while their ownership appeared as numeric identity 0 rather than a named administrator.

This is a hunting lead, not proof by itself, since legitimate objects may have unusual ownership. If compromise is suspected, collect the configuration and logs before resetting the router.

Rebuild it from a verified baseline, rotate every password, key, and other secret it stored or could have observed, and limit SSH to trusted administration networks.

These steps can prevent the traffic monitoring and internal access seen in Cisco router espionage incidents, where compromised gateways supported broader intrusion.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC