Alert: Immediate Threats to Mikrotik Routers

Threat Summary

We recently observed a concerning incident involving a threat group specializing in exploiting vulnerable Mikrotik routers running outdated RouterOS. Within minutes, we detected the group attempting to brute-force access via Telnet.

Evidence of Attack Activity

The screenshot above shows the initial reconnaissance and brute-force attempts targeting exposed Mikrotik devices.

Further analysis revealed systematic scanning patterns targeting management interfaces.

Attack Details

Attack Vector

• Telnet brute-force attacks
• Exploitation of known RouterOS vulnerabilities
• Default credential abuse

Observable Activity

• Rapid login attempts on port 23 (Telnet)
• Scanning for management interfaces
• Attempted exploitation of CVE-2018-14847 and similar

Affected Devices

Consequences of Compromise

1. Botnet Recruitment: Compromised routers used in DDoS attacks
2. Traffic Interception: Man-in-the-middle attacks
3. Cryptomining: Resources hijacked for cryptocurrency mining
4. Lateral Movement: Gateway to internal networks
5. Data Theft: Capture of network traffic

Immediate Actions Required

Critical Steps

1. Update RouterOS: Upgrade to the latest stable version immediately
2. Disable Telnet: If not needed, disable Telnet service completely
3. Change Credentials: Use strong, unique passwords
4. Firewall Rules: Restrict management access to trusted IPs
5. Enable Logging: Monitor for suspicious access attempts

Configuration Commands

# Disable Telnet
/ip service disable telnet

# Restrict Winbox access
/ip service set winbox address=192.168.0.0/24

# Change default admin password
/user set admin password=YourSecurePassword

Monitoring

Watch for:

• Unexpected configuration changes
• Unknown scheduled scripts
• Unusual traffic patterns
• Failed login attempts

WhiteHat NG Infrastructure Alert