CloudSEK uncovers the Doorway botnet. The Rust Doorway botnet exploits routers, cameras, and servers to build a global proxy network.

Related Posts:

• NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks
• Synology NAS Ransomware Targets Unpatched Devices
• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace

The post Rust Doorway Botnet Exploits Routers, Cameras, and Servers appeared first on Daily CyberSecurity.

A critical MikroTik RouterOS vulnerability, CVE-2026-84411 (CVSS 9.8), lets unauthenticated attackers run code as root. Update RouterOS now.

Related Posts:

• Critical Apache PLC4X Flaw Lets Attackers Hijack OPC UA Connections to PLCs
• TeamViewer Fixes Five High-Severity Flaws in Full Client and Host
• Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities

The post Critical MikroTik RouterOS Flaw CVE-2026-84411 Allows Unauthenticated Root RCE appeared first on Daily CyberSecurity.

MikroTrick chains two RouterOS flaws to bypass authentication and gain admin access. AI helped researchers uncover the attack chain within days.

MikroTik pushed out patches on September 3, 2026 for several RouterOS issues at once, calling it an important security update without saying what it actually fixed. That silence was deliberate, and it didn’t last long. Within days, researchers had reconstructed the whole attack chain from the patch files themselves.

CERT Polska’s Sławomir Rozbicki had reported some of the underlying bugs through coordinated disclosure, and the team expected to publish alongside MikroTik’s release. The vendor shipped early instead. That gap between “patch is out” and “details are public” turned out to be shorter than anyone planned for, and it’s the whole story here.

Once the new RouterOS versions landed, CERT Polska started diffing the packages, comparing patched code against the old builds line by line. They found the login program now rejected usernames starting with a hyphen or a space, something that hadn’t been validated before. They also found a new check that specifically watched for a privileged account named “ops” appearing out of nowhere and automatically disabled it, which told them the vendor already had some idea attacks were happening.

That detail led them to public forums, where administrators had been sharing suspicious log entries for several days. Two lines appeared again and again: a failed login attempt for a user named “-2,” followed by the creation of a fully privileged “ops” account. A failed login that still results in an admin account is not normal. It was a clear sign that something was wrong.

By comparing the patch with those logs, CERT Polska identified a new critical flaw, CVE-2026-86060, in about an hour and gave MikroTik a working proof of concept. Combined with another vulnerability, CVE-2026-67279, the two flaws could give an attacker full administrative access without a password, SSH key, or successful authentication. The researchers called the attack chain MikroTrick, showing how the vulnerabilities could be chained together to abuse the protocol.

Here’s the mechanism, and it’s worth slowing down for. SSH normally won’t let a client touch anything until authentication succeeds, that’s the whole point of the protocol’s layered design. But RouterOS handled something called a rekey, a routine renegotiation of encryption keys mid-session, incorrectly if it happened while authentication was still in progress. Finish that rekey, and the server would skip straight to channel handling as if authentication had already succeeded, even though it never actually did.

That alone doesn’t hand over any privileges. It just gets an attacker into the room. The second bug is what turns “in the room” into “root access.”

When a client starts a session, RouterOS creates a login process and passes it the username and a numeric privilege level as command-line arguments. The problem is that the username is sent to the server before authentication is complete and is not properly sanitized before being passed to the login process.

An attacker can send -2 instead of a normal username. The login process treats -2 as an option that points to file descriptor 2, which is connected to the same terminal channel controlled by the attacker.

This allows the attacker to control the username and privilege information through the SSH connection itself. By setting the privilege mask to 655358, which represents the fully privileged group, the attacker can obtain administrator rights without ever successfully authenticating.

“Combining the two vulnerabilities resulted in full unauthenticated access to the administrative console.” reads the advisory published by CERT Polska. “CVE-2026-67279 allowed an unauthenticated client to create a session channel, while CVE-2026-86060 allowed it to supply login with an attacker-controlled policy mask.”

The tell in the logs, that failed login for user “-2” followed immediately by a new privileged account, matches this exploit chain exactly. CERT Polska is confident MikroTrick was being used in the wild before the patches even existed. Attack logs collected from the MikroTik forum, Reddit, and direct reports to CERT Polska show a consistent source IP, 82.192.72.4, repeatedly attempting this exact sequence, and in several cases succeeding well enough to pull diagnostic files off the compromised routers afterward.

One detail stands out: AI played a major role in the research. CERT Polska used GPT-5.5-cyber and GPT-5.6-sol through OpenAI’s GTAC program, together with locally hosted open-weight models, to build an isolated lab with 40 virtual RouterOS devices covering 24 different versions.

The AI agents helped analyze binaries, test unusual protocol behavior, including out-of-order messages and rekeying before authentication, and monitor public forums for signs that the exploit was spreading. One of those tests led directly to the discovery of CVE-2026-67279.

This is the bigger issue for vendors. Once a patch is released, researchers using similar AI tools can analyze the changes and reconstruct the original vulnerability very quickly. In this case, a public analysis on npratley.net identified the key SSH changes by September 4, less than 24 hours after the patch. By September 5, the “-2” file descriptor trick was already being discussed publicly on Reddit and MikroTik’s forum.

“The speed of LLM-assisted patch analysis is blurring the line between releasing an update and publishing the technical details of a vulnerability. In the case of MikroTrick, the key elements of the flaws were identified publicly within days.” concludes the advisory. “The lower cost of code analysis did not, however, reduce the time required to test and deploy updates or to examine systems for evidence of prior compromise.”

That’s the actual asymmetry worth worrying about, not that attackers move fast, but that patching and forensic cleanup still move at the old, slow pace while reverse engineering has gotten dramatically cheaper. CISA added two of these CVEs to its Known Exploited Vulnerabilities catalog on September 10, with a three day remediation deadline, which tells you how seriously the US government is treating the gap between disclosure and real-world exploitation here.

If you’re running RouterOS anywhere in your infrastructure, particularly on devices exposed to SSH from the internet, patching isn’t optional at this point and it isn’t really about the CVE numbers either. It’s about the fact that the exploit code is already circulating and the identifying log pattern, a rejected login from a user literally named “-2”, is sitting right there for anyone checking their own logs today.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MikroTik)

CERT Polska warns that attackers are actively exploiting a chain of critical MikroTik RouterOS flaws to seize control of routers exposed to the internet.

Although the warning comes from Poland’s national cybersecurity response team, MikroTik routers are sold worldwide, including in the US. The vulnerabilities can affect users anywhere if their router is running a vulnerable version of RouterOS and its SSH remote-management service is accessible from the internet.

Attackers are exploiting two vulnerabilities, collectively dubbed “MikroTrick,” to take full control of vulnerable devices, CERT Polska says.

A compromised router is especially serious because it sits at the edge of your network. An intruder may be able to change DNS settings, redirect or capture traffic, create remote-access tunnels, alter firewall rules, or use the device as a foothold to attack other devices on the network.

Two of the six disclosed vulnerabilities form the chain of compromise known as MikroTrick. The first, tracked as CVE-2026-67276, is an SSH authentication-bypass flaw in the handling of RSA public keys. The second, CVE-2026-86060, is a privilege-escalation flaw involving a specially crafted username in the SSH login process.

Put simply, the first flaw lets attackers get in without a password, and the second lets them make themselves an administrator.

SSH (short for Secure Shell) is a network protocol that establishes encrypted connections between computers for secure remote access.

CERT Polska issued the warning because the patched RouterOS packages are already public, and their comparative analysis has allowed the community to reconstruct some of the flaws they fix. 

How to stay safe

MikroTik router owners should install the latest RouterOS security update as soon as possible. Use the router’s update mechanism or obtain the supported package directly from MikroTik. The update option should be available under Check for updates.

You should also remove public access to the router’s management services. Make sure that SSH is not accessible from untrusted networks. If remote administration is necessary, limit access to known IP addresses.

Remote management should be the exception, not the default. MikroTrick demonstrates that a strong password alone cannot protect a device from an authentication-bypass vulnerability.

MikroTik has added a detection mechanism that scans the configuration at startup for selected signs of unauthorized changes. If it finds any, RouterOS disables the recognized suspicious entries and sets the device’s Flagged status to Yes. Administrators can check this with /system/device-mode/print.

RouterOS restricts several potentially abusable functions while the device is flagged, but MikroTik stresses that the router’s full configuration still needs to be audited before the flag is cleared.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.

Microsoft said in a blog post today it identified more than 200 organizations and 5,000 consumer devices that were caught up in a stealthy but remarkably simple spying network built by a Russia-backed threat actor known as “Forest Blizzard.”

How targeted DNS requests were redirected at the router. Image: Black Lotus Labs.

Also known as APT28 and Fancy Bear, Forest Blizzard is attributed to the military intelligence units within Russia’s General Staff Main Intelligence Directorate (GRU). APT 28 famously compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.

Researchers at Black Lotus Labs, a security division of the Internet backbone provider Lumen, found that at the peak of its activity in December 2025, Forest Blizzard’s surveillance dragnet ensnared more than 18,000 Internet routers that were mostly unsupported, end-of-life routers, or else far behind on security updates. A new report from Lumen says the hackers primarily targeted government agencies—including ministries of foreign affairs, law enforcement, and third-party email providers.

Black Lotus Security Engineer Ryan English said the GRU hackers did not need to install malware on the targeted routers, which were mainly older Mikrotik and TP-Link devices marketed to the Small Office/Home Office (SOHO) market. Instead, they used known vulnerabilities to modify the Domain Name System (DNS) settings of the routers to include DNS servers controlled by the hackers.

As the U.K.’s National Cyber Security Centre (NCSC) notes in a new advisory detailing how Russian cyber actors have been compromising routers, DNS is what allows individuals to reach websites by typing familiar addresses, instead of associated IP addresses. In a DNS hijacking attack, bad actors interfere with this process to covertly send users to malicious websites designed to steal login details or other sensitive information.

English said the routers attacked by Forest Blizzard were reconfigured to use DNS servers that pointed to a handful of virtual private servers controlled by the attackers. Importantly, the attackers could then propagate their malicious DNS settings to all users on the local network, and from that point forward intercept any OAuth authentication tokens transmitted by those users.

DNS hijacking through router compromise. Image: Microsoft.

Because those tokens are typically transmitted only after the user has successfully logged in and gone through multi-factor authentication, the attackers could gain direct access to victim accounts without ever having to phish each user’s credentials and/or one-time codes.

“Everyone is looking for some sophisticated malware to drop something on your mobile devices or something,” English said. “These guys didn’t use malware. They did this in an old-school, graybeard way that isn’t really sexy but it gets the job done.”

Microsoft refers to the Forest Blizzard activity as using DNS hijacking “to support post-compromise adversary-in-the-middle (AiTM) attacks on Transport Layer Security (TLS) connections against Microsoft Outlook on the web domains.” The software giant said while targeting SOHO devices isn’t a new tactic, this is the first time Microsoft has seen Forest Blizzard using “DNS hijacking at scale to support AiTM of TLS connections after exploiting edge devices.”

Black Lotus Labs engineer Danny Adamitis said it will be interesting to see how Forest Blizzard reacts to today’s flurry of attention to their espionage operation, noting that the group immediately switched up its tactics in response to a similar NCSC report (PDF) in August 2025. At the time, Forest Blizzard was using malware to control a far more targeted and smaller group of compromised routers. But Adamitis said the day after the NCSC report, the group quickly ditched the malware approach in favor of mass-altering the DNS settings on thousands of vulnerable routers.

“Before the last NCSC report came out they used this capability in very limited instances,” Adamitis told KrebsOnSecurity. “After the report was released they implemented the capability in a more systemic fashion and used it to target everything that was vulnerable.”

TP-Link was among the router makers facing a complete ban in the United States. But on March 23, the U.S. Federal Communications Commission (FCC) took a much broader approach, announcing it would no longer certify consumer-grade Internet routers that are produced outside of the United States.

The FCC warned that foreign-made routers had become an untenable national security threat, and that poorly-secured routers present “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”

Experts have countered that few new consumer-grade routers would be available for purchase under this new FCC policy (besides maybe Musk’s Starlink satellite Internet routers, which are produced in Texas). The FCC says router makers can apply for a special “conditional approval” from the Department of War or Department of Homeland Security, and that the new policy does not affect any previously-purchased consumer-grade routers.