[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4gjUPs95RNX1ilV4Gk54pUch_BMCy1OSJR4os7wRqoA":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"d06be073-0587-4841-bb52-476336acbd89","Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication","attackers-hijack-mikrotik-routers-through-internet-exposed-ssh-without-authentic-bec3d4","Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or","Attackers are gaining full administrative control of MikroTik routers by exploiting internet-exposed SSH services without authentication. CERT Polska issued a warning on September 5, with attacks dating back to September 2. MikroTik has released security updates for various RouterOS versions, and users are urged to install them immediately and check for unauthorized configuration changes.","Attackers exploit unauthenticated SSH on MikroTik routers for admin control.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-hijack-mikrotik-routers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjiSiBDO5j21gorWS-UjrLlDl0RzniibBPjfO4xfPBBLbH1yTQIB88G-hUBRtYNufYwkPpVjWWLu0GXk1TB7pv_x8KbQCbfsL5Ft8JlZLa6iZfvuHU-vKSPNq5Li-e9DtoOvZIOXPYmibx9uc_imnug4ZJUog31KwlA3YKmY8ghOpROVQR8mwPj9qb-1kA\u002Fs1600\u002Fmicro.jpg","2026-09-06T09:32:38+00:00","2026-09-06T10:00:12.904135+00:00",8,[17,20,23,26],{"name":18,"type":19},"MikroTik","vendor",{"name":21,"type":22},"RouterOS","product",{"name":24,"type":25},"SSH","technology",{"name":27,"type":28},"CERT Polska","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37,42],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"malware","MikroTrick","Name given by CERT Polska to the two-flaw combination used in the attacks.",[18,21],{"controls":54,"vendors":120},[55,84,91],{"slug":56,"name":57,"problem":58,"products":59},"patch-management","Automated patch management","Known holes get closed in days, not months.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[89,90],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},{"slug":92,"name":93,"problem":94,"products":95},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","secure-firewall","Cisco Secure Firewall","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Ffirewalls\u002Findex.html","Next-generation firewalls with intrusion prevention, using Talos threat intelligence.",[],{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":137},"mikrotik-routers-hijacked-via-unauthenticated-internet-exposed-ssh","MikroTik Routers Hijacked via Unauthenticated Internet-Exposed SSH","Attackers achieved full administrative control of MikroTik routers by exploiting SSH services that were exposed to the internet without authentication — a critical misconfiguration that should never exist on any production network device. This incident highlights the severe risk of leaving management interfaces publicly accessible, as attackers can gain root-level access with zero friction. MikroTik released patches promptly, but the damage window opened because organizations failed to enforce authentication on a sensitive protocol and did not restrict SSH exposure to trusted networks. Beyond patching, the warning about unauthorized configuration changes underscores that compromise can persist silently unless post-incident audits are performed. Network appliances are high-value targets because their compromise grants attackers a privileged vantage point for traffic interception, lateral movement, and persistent footholds.",[126,127,128,129,130,131,132,133,134,135,136],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 IA-2: Identification and Authentication","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF PR.AC-3: Remote Access Management","NIST CSF PR.PT-3: Least Functionality","ISO\u002FIEC 27001 A.9.4: System and Application Access Control","ISO\u002FIEC 27001 A.12.6: Technical Vulnerability Management",{}]