The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, attackers exploited the MikroTrick vulnerability chain (CVE-2026-67279 and CVE-2026-86060) to gain full administrative control of internet-exposed MikroTik routers without passwords or SSH keys. The attack combined an SSH state-machine flaw that bypassed authentication with an argument-injection vulnerability in RouterOS login process. Evidence shows active exploitation began September 2, 2026, one day before patches were released, with attackers creating privileged accounts and exfiltrating configuration data from compromised devices.

This incident highlights the growing threat to network infrastructure devices as nation-state actors and cybercriminals increasingly target routers and edge devices for persistent access and lateral movement capabilities.

Why This Matters Now

Network infrastructure devices like routers have become primary targets for establishing persistent footholds in enterprise networks, with recent campaigns by groups like Salt Typhoon demonstrating how compromised edge devices enable long-term espionage and data theft operations.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attack combines CVE-2026-67279 (SSH state-machine bypass) with CVE-2026-86060 (argument injection) to skip authentication and inject administrative privileges through the RouterOS login process.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly reduced the blast radius of this MikroTik router compromise by constraining lateral movement and limiting the attacker's ability to pivot into segmented network zones.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Network segmentation policies would likely have limited the attacker's initial foothold to isolated perimeter zones, reducing their ability to immediately access critical internal infrastructure segments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware access controls would likely have restricted the scope of administrative privileges available to the compromised router, limiting its ability to influence broader network routing decisions.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Microsegmentation enforcement would likely have blocked unauthorized east-west traffic flows from the compromised router, significantly limiting the attacker's ability to reach internal network segments and critical assets.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Network traffic inspection and anomaly detection would likely have identified suspicious command and control communications, limiting the attacker's ability to maintain persistent administrative access across network segments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely have blocked or flagged unauthorized outbound data transfers from network infrastructure components, reducing the attacker's ability to exfiltrate sensitive configuration and topology information.

Impact (Mitigations)

The overall network impact would likely have been significantly reduced through segmentation boundaries, limiting the attacker's surveillance scope to isolated network zones rather than enterprise-wide infrastructure visibility.

Impact at a Glance

Affected Business Functions

  • Network Infrastructure Management
  • Internet Gateway Services
  • Remote Access Management
  • Network Security Operations
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: N/A

Data Exposure

Complete router configuration data, network topology information, authentication credentials, VPN configurations, and administrative access credentials were potentially exfiltrated to attacker infrastructure at IP addresses 82.192.72.4 and 103.102.31.18.

Recommended Actions

  • • Implement Zero Trust segmentation to isolate network infrastructure devices and limit lateral movement from compromised routers
  • • Deploy egress security controls to detect and block unauthorized diagnostic file transfers and configuration data exfiltration
  • • Enable multicloud visibility and anomaly detection to identify suspicious SSH authentication patterns and failed login attempts for unusual usernames like '-2'
  • • Establish encrypted traffic monitoring to detect unencrypted management protocols and implement secure hybrid connectivity for infrastructure management
  • • Apply inline intrusion prevention with signature-based detection to identify and block known exploit patterns targeting network device vulnerabilities

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image