MikroTik Archives • Daily CyberSecurity

Rust Doorway Botnet Exploits Routers, Cameras, and Servers

Doorway botnet and Rust Doorway botnet architecture diagram

Rust Doorway Botnet Exploits Routers, Cameras, and Servers

Do Son November 2, 2026

CloudSEK uncovers the Doorway botnet. The Rust Doorway botnet exploits routers, cameras, and servers to build a global proxy network.

Critical MikroTik RouterOS Flaw CVE-2026-84411 Allows Unauthenticated Root RCE MikroTik RouterOS vulnerability CVE-2026-84411, an unauthenticated integer underflow in the web management service enabling root remote code execution

MikroTik RouterOS vulnerability CVE-2026-84411, an unauthenticated integer underflow in the web management service enabling root remote code execution

Critical MikroTik RouterOS Flaw CVE-2026-84411 Allows Unauthenticated Root RCE

Do Son September 29, 2026

A critical MikroTik RouterOS vulnerability, CVE-2026-84411 (CVSS 9.8), lets unauthenticated attackers run code as root. Update RouterOS now.

MikroTrick PoC: RouterOS Admin Rights Exploited In Wild MikroTik RouterOS MikroTrick vulnerability chain exploited in the wild for full administrative privileges via SSH, with public PoC exploit code

MikroTik RouterOS MikroTrick vulnerability chain exploited in the wild for full administrative privileges via SSH, with public PoC exploit code

MikroTrick PoC: RouterOS Admin Rights Exploited In Wild

Do Son September 7, 2026

The MikroTrick PoC is publicly disclosed. This MikroTrick RouterOS flaw is actively exploited in the wild, granting full administrative privileges.

MikroTik RouterOS Vulnerability Exploited in the Wild: Patch and Defense Blueprint MikroTik RouterOS security update fixes critical vulnerability

MikroTik RouterOS security update fixes critical vulnerability

MikroTik RouterOS Vulnerability Exploited in the Wild: Patch and Defense Blueprint

Do Son September 5, 2026

A critical MikroTik RouterOS vulnerability is actively exploited in the wild. Learn how to detect rogue ops accounts and apply the latest firmware updates.

MikroTik RouterOS Flaw CVE-2026-16347 Helps Attackers Gain Unauthorized System Access MikroTik RouterOS vulnerability CVE-2026-16347 enabling brute-force attacks and unauthorized system access

MikroTik RouterOS vulnerability CVE-2026-16347 enabling brute-force attacks and unauthorized system access

MikroTik RouterOS Flaw CVE-2026-16347 Helps Attackers Gain Unauthorized System Access

Do Son August 1, 2026

CVE-2026-16347 lets attackers brute-force MikroTik RouterOS logins for unauthorized system access. Rated CVSS 8.8, with no fix yet. Apply mitigations.

The Invisible Hijack: How FrostArmada Turned 18,000 Routers Into a Global Spy Network FrostArmada Campaign DNS Redirection

The Invisible Hijack: How FrostArmada Turned 18,000 Routers Into a Global Spy Network

Do Son April 13, 2026

Russian-linked Forest Blizzard's FrostArmada campaign hijacked 18,000+ routers to steal OAuth tokens via DNS redirection. Learn how they stayed invisible.

APT28 Hijacks Home Routers to Steal Corporate Credentials

GemStuffer RubyGems Campaign RubyGems Data Exfiltration TanStack npm Compromise Supply Chain Attack DNS Hijacking APT28 (Fancy Bear) OpenVSX Supply Chain Attack Checkmarx Plugin Breach Stryker Cyberattack CISA Alert Trans-Regional Cyber Conflict Operation Epic Fury Cyber Operation MacroMaze APT28 Cyber Espionage Notepad++ Supply Chain Attack Lotus Blossom Group Defense Industrial Base Threats GTIG Report APT28 Operation Neusploit CVE-2026-21509 Bookworm Malware

APT28 Hijacks Home Routers to Steal Corporate Credentials

Do Son April 8, 2026

NCSC unmasks APT28’s "digital funnel" using router DNS hijacking to steal OAuth tokens and passwords. Protect your remote workforce—patch your routers now.

Critical MikroTik Flaw (CVE-2025-61481, CVSS 10.0) Exposes Router Admin Credentials Over Unencrypted HTTP WebFig MikroTik HTTP Credential Leak, WebFig MitM CVE-2025-61481

MikroTik HTTP Credential Leak, WebFig MitM CVE-2025-61481

Critical MikroTik Flaw (CVE-2025-61481, CVSS 10.0) Exposes Router Admin Credentials Over Unencrypted HTTP WebFig

Do Son October 29, 2025

A Critical (CVSS 10.0) flaw (CVE-2025-61481) in MikroTik RouterOS/SwOS exposes the WebFig management interface over unencrypted HTTP by default, allowing remote credential theft via MitM.

13,000 MikroTik Routers Hijacked for Global Malspam Operation CloudComputating - QSC framework

13,000 MikroTik Routers Hijacked for Global Malspam Operation

Do Son January 15, 2025

Uncover the dangers of DNS misconfiguration and its role in a massive botnet operation. Learn how hackers exploit SPF records to distribute malware.