The tell is a new administrator. On MikroTik routers hit in the past few days, Poland's national CERT found a highly privileged user named "ops" that nobody on the owner's side had created, sitting beside log lines that record a failed login for a user called "-2" and then a new user being added "by ssh". Anyone running RouterOS with SSH reachable from the internet should go and look for those three things now.
They are the fingerprints of an attack CERT Polska calls MikroTrick. It needs no password.
In a warning published on 5 September, CERT Polska says it found six vulnerabilities in RouterOS, the operating system that runs MikroTik's routers and wireless gear, and coordinated their disclosure with the vendor. Two of the six combine to give full control of a device with no credentials at all, provided the router accepts SSH connections from outside. The team says it has confirmation that attackers are already using that combination against internet-exposed RouterOS devices, that the successful intrusions so far trace back to a single IP address, and that the activity has run since at least 2 September. The released patches, it adds, stop the attacks it has observed.
MikroTik has shipped the fixes in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. CERT Polska adds that, for the first time, MikroTik also pushed a notification to the phones of everyone with the MikroTik app installed to get the word out.
Two of six bugs make a chain that needs no password
CERT Polska describes the three most serious flaws in its post and lists all six, with affected versions, on a separate advisory page. Every one of them affects RouterOS from 7.24 before 7.24.2, from 7.0 before 7.23.4 and from 6.0 before 6.49.21, which is to say more or less every RouterOS build that was current a week ago.
- CVE-2026-67276, SSH authentication bypass (CVSS 9.2). RouterOS checked the type and modulus of an RSA public key but not its exponent when matching an SSH login against a user's authorised key. An attacker who knew a username and that key's modulus could craft a different key, forge a valid signature and log in as that user without the private key.
- CVE-2026-86060, privilege manipulation through a crafted username (CVSS 9.2). The SSH login path mishandled usernames beginning with a prohibited character; a crafted one changed the RouterOS policy mask and yielded a session with full administrative rights.
- CVE-2026-67277, memory disclosure and crash via bandwidth-test (CVSS 8.8). The bandwidth-test service accepted a "related" connection before the primary session had authenticated, from which an unauthenticated client could leak uninitialised kernel packet-buffer data or trigger an integer underflow that restarts the kernel.
The other three are no less interesting. CVE-2026-67279 lets an SSH client that has never authenticated request a rekey, open a session channel and send a command the server runs, enough to create or overwrite files in RouterOS's managed file namespace. CVE-2026-67281 is an unauthenticated file read in the WebFig web interface that can be steered to disclose root-owned files, among them configuration stores containing credentials. CVE-2026-67278 is a certificate-checking flaw: RouterOS accepted malformed RSA signatures during X.509 validation, so anyone who could redirect an outbound TLS connection from the router could forge a trusted intermediate and impersonate the server.
CERT Polska has not said which two flaws form MikroTrick, and that is deliberate. It is limiting the description to what administrators need and publishing no exploit code, and it is publishing at all, ahead of schedule, because the patched packages are public and comparing them with the old ones has already let the community reconstruct some of the fixes.
What the attackers leave behind
The observed intrusions leave two lines in the RouterOS log: login failure for user -2 from <ip> via ssh, followed by user <name> added by ssh:-2@<ip>. The third artefact is that highly privileged "ops" account. CERT Polska attributes the successful attacks so far, including creation of the ops user, to 82[.]192[.]72[.]4, active since at least 2 September, and says 103[.]102[.]31[.]18 was used in attempts. Any one of those traces means an exploitation attempt and must be investigated immediately; their absence, CERT Polska stresses, does not rule out unauthorised activity.
The patched router checks itself for tampering
The fixed releases carry something unusual. At startup, RouterOS now scans its own configuration for known signs of unauthorised changes, disables the suspicious entries it recognises, writes a critical message to the log and sets a warning called the "Flagged" marker. MikroTik's documentation describes the procedure and what to do when a device is flagged.
CERT Polska is careful about what that marker means. It catches only selected traces of a compromise, so a device that is not flagged is not thereby clean. And because the team cannot rule out further bugs the vendor did not describe in the changelog, a flagged device is evidence of a possible earlier compromise, not proof that one of the six reported flaws was the way in. Either way: treat a flagged router as taken over.
MikroTik's own bulletin says less than the CERT does
We read MikroTik's own advisory to see whether the two accounts line up. MikroTik's September 2026 security bulletin, dated 3 September, lists exactly the four fixed releases CERT Polska names, and it describes the same post-upgrade Flagged check. On the substance, though, the vendor's page is far quieter. As of this writing it speaks of "a security vulnerability", singular, found by MikroTik; it says most configurations are not at risk; and it says the company is not currently publishing detailed information, to give people time to update. It promises more in due time.
Here is what that does and does not show. It does not show that the two organisations disagree about the facts: MikroTik says it is withholding detail on purpose, and CERT Polska says it went public early precisely because the fixes could already be reverse-engineered. It does show that an administrator who read only the vendor's page would not have known that six flaws were involved, that two chain into a takeover with no password, or that attackers were already using them. Set the dates side by side and the gap is starker: CERT Polska puts the earliest confirmed intrusions at 2 September, the day before MikroTik's bulletin appeared. The version numbers agree. The urgency does not.
Found by AI agents, proven on real hardware
How the bugs were found is a story in itself. CERT Polska says it discovered them using OpenAI's GPT-5.5-cyber and GPT-5.6-sol models, which it can use through the OpenAI Government and Trust Agency Collaboration programme. The models ran inside an agent-based research environment that automated a lab of MikroTik machines: building and restoring them, comparing RouterOS versions, reading RFCs and binary code, and writing scripts to confirm a suspected bug. The technique the team singles out as most productive was modelling protocols as state machines and asking what happens when a step is skipped, repeated or run out of order, which describes several of the flaws above.
The team is equally clear about what the models did not do. None of this came from a single prompt. Every hypothesis had to be confirmed on a real RouterOS system, checked against negative controls, repeated on a clean machine and assessed for impact by the researchers, and the most labour-intensive work was the human part: building context about RouterOS, designing a safe lab, choosing directions, then weeding out false conclusions. That is a more sober account of AI-assisted vulnerability research than Unit 42's demonstration of AI agents breaching a company in under ten hours, and it comes from a team that has just used the method to find a chain that is being exploited in the wild.
Update to 7.24.2, 7.23.4 or 6.49.21, then hunt for "ops"
CERT Polska's recommendations, in order:
- Update RouterOS immediately to 7.25beta3, 7.24.2, 7.23.4 or 6.49.21.
- Then check the log for the device-compromise message and read the flagged value in /system/device-mode/print.
- Go through the configuration for unknown users, scripts, scheduler tasks, proxy servers and tunnels. No marker does not mean no compromise.
If the patch cannot go on straight away, cut the attack surface until it can: disable SSH, WWW, WWW-SSL and the bandwidth-test server, or block them from every address outside your trusted management networks, and do not start TLS connections or use the built-in SSH clients from an unpatched device. CERT Polska calls these temporary measures that do not replace the update.
If the Flagged marker, the log lines, the configuration or anything else points to a compromise, assume the device has been taken over. Isolate it, secure its logs and configuration before resetting it, and report the attack to your CSIRT. Then restore factory settings, rebuild from a trusted configuration, and change every password, key and secret it used. Do not restore a full backup from a device that may have been compromised, and do not clear the Flagged marker until the analysis is finished.
Routers are the doorway, and this is the second time this summer a government body has had to say so: in July twelve countries warned that Russia's FSB was hijacking weakly secured routers for espionage. This time the intruders are unnamed and the hole is fresh, found in a lab in Poland by researchers directing AI agents, and used in anger before the vendor had finished its bulletin. The only party that can close that gap is whoever owns the router.
Indicators (defanged)
- 82[.]192[.]72[.]4 (source of the successful attacks observed by CERT Polska, active since at least 2 September)
- 103[.]102[.]31[.]18 (used in exploitation attempts)
- Highly privileged RouterOS user named "ops"
- Log lines: login failure for user -2 from <ip> via ssh; user <name> added by ssh:-2@<ip>
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.