Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”

MikroTik RouterOS SSH zero-day (MikroTrick chain) under active exploitation since Sept 2. Patch to 7.24.2, 7.23.5, or 6.49.21 immediately and check logs.

Anyone running a MikroTik router with SSH exposed to the internet should treat it as compromised until proven otherwise. The popular cybersecurity expert Costin Raiu published a detailed technical breakdown of the active exploitation on September 5, 2026, the same day CERT Polska issued its advisory titled “Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended.”

“If you have a MikroTik router on the internet with SSH open, it may already be compromised” Raiu wrote on Medium.

The attack chain being exploited is called MikroTrick and combines two of six vulnerabilities CERT Polska discovered and disclosed: CVE-2026-67276 (CVSS score of 9.2), an SSH authentication bypass, and CVE-2026-86060, an SSH session privilege escalation.

“The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS. Combining two of them allows an attacker to take full control of the device without authentication if the device supports remote access using the SSH protocol. To make this chain easier to identify, we have given it a common name, MikroTrick.” states CERT Polska. “In recent days we have been observing attacks against RouterOS devices accessible from the internet. “

CVE-2026-67276 flaw stems from how RouterOS verifies RSA public keys. If an attacker knows a valid username and the public part of the user’s RSA key, they can create a fake key and log in without the private key.

When combined with the privilege-escalation flaw, the attack can give an attacker full administrator access to any internet-exposed RouterOS device with SSH enabled.

“MikroTik has released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21 on September 3, however, it would appear that exploitation began as early as September 2, making it a 0day.” Raiu added. “This seems to suggest someone got hold of the news the patches were dropping and began exploiting it at scale.”

A Polish security forum contained logs showing September 2 exploitation attempts, and CERT Polska confirmed successful attacks including the creation of an “ops” account dating to at least September 2.

Most of the attacks observed so far originated from 82.192.72[.]4, a Leaseweb IP that was hosting a busybox binary (a MIPS build from 2010, identical to the official BusyBox 1.16.1 precompiled binary), alongside three other files: ftpsrv.py, launch.sh, and serve.py. A second IP, 103.102.31[.]18, has also been associated with the campaign. Three of the four hosted files have no VirusTotal detections as of writing.

MikroTik routers are popular because they can run for years with little attention. But that also makes SSH vulnerabilities more dangerous. Devices that haven’t received updates in years may not get patched before attackers start exploiting a new flaw.

Defenders can detect attacks by looking for specific log entries. Failed login attempts show the username -2, which isn’t a valid account and shouldn’t appear in normal logs. A successful attack appears in /system history as ssh:-2@<IP>, followed by an action such as creating a user, adding an SSH key, changing firewall rules, or enabling a proxy or tunnel.

“When one is attached to a configuration action—especially the creation or modification of users, SSH keys, scripts, schedulers, services, firewall rules, proxies, tunnels, or packet-sniffing settings—treat it as confirmed compromise unless it came from an authorized security test.” concluded Raiu. “Do not assume the device is safe merely because no -2 login failure appears: logs may have rolled over or cleaned.”

The creation of an account named “ops” is an additional confirmed indicator of compromise in the observed attacks.

Raiu tested the reproducibility of the exploit using four different AI tools. Astra refused on safety grounds and suggested he apply for cyber verification. The other three (Sol, Daybreak Blue, and GLM-5.3) were willing to help but none could complete a working implementation. That gap gives defenders an estimated one to two days before a working proof of concept appears publicly on GitHub, which is better than nothing but not by much given that exploitation is already happening at scale from a single IP.

CERT Polska noted something unusual: MikroTik sent push notifications through its official mobile app to alert users about the vulnerabilities, a first for the company. Patched versions are 7.25beta3, 7.24.2, 7.23.4, 7.23.5 (released September 4), and 6.49.21. Devices using MikroTik’s default firewall configuration and not directly exposing SSH to the public internet are likely protected, but any device with SSH reachable from untrusted networks should be patched immediately and inspected for the indicators above.

The full list of IOCs from Raiu’s analysis: IPs 82.192.72[.]4 and 103.102.31[.]18; file hashes 6e95f70fdbabb57881b3f5b2c8465d4b17ba901100704efb1278bb3386e6729d (ftpsrv.py), 972b474b896f9fac3cd6b5b8476b410b8f39fbedee8a3b0c745d6e3b328d7dcd (launch.sh), and 6dca83338d60467b65b7789d4d59754e40a7aaa36f40ea2da57538367ac9b89e (serve.py).

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MikroTik)