#MIKROTIK ROUTEROS BASED BOTNET PATCH#

There were also good guys, that hacked routers to upgrade it and patch it at some point. My guess and observation is, that since 2018 there was botnet war going on, who will take control of the vulnerable MikroTik devices, i even saw scripts that adds protection against other attacks after initial infection, so that nobody would overwrite first hack. If you had your credentials on at least one compromised router - all routers with those credentials and open ssh/winbox/web port will be compromised - botnet will just brute force the password and will eventually get in and take control. If you just upgrade RouterOS without anything else, you will still be part of the botnet, but with newest version. (reset configuration to default if not sure) A Russian-speaking grey-hat hacker is breaking into peoples MikroTik routers and patching devices so they cant be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has. Use 'Export' command to see all your configuration and inspect for any abnormalities, such as unknown SOCKS proxy settings and scripts, L2TP configuration, and firewall rules that you didn't made.

Include your LAN, and the public IP that you will be accessing the device from. 'IP -> Services' menu to specify 'Allowed From' addresses.

Change your credentials - cause they are now in public hacking database.

So official view is, if you had a router with affected version:Affected all bugfix releases from 6.30.1 to 6.40.7, fixed in 6.40.8 on 2018-Apr-23Affected all current releases from 6.29 to 6.42, fixed in 6.42.1 on 2018-Apr-23Affected all RC releases from 6.29rc1 to 6.43rc3, fixed in 6.43rc4 on on 2018-Apr-23ДЄnd at any point of time it was compromised,you need to ALL of these

Mikrotik routeros-based botnet