MikroTik RouterOS SSH Zero-Day Vulnerability MikroTrick Chain Under Active Exploitation

MikroTik RouterOS is affected by an SSH zero-day vulnerability called the MikroTrick chain that has been under active exploitation since September 2. Users are advised to patch to versions 7.24.2, 7.23.5, or 6.49.21 immediately. Compromised routers can be identified by checking logs for an SSH user named "-2". Cybersecurity expert Costin Raiu published a detailed technical breakdown of the active exploitation. MikroTik routers with SSH exposed to the internet should be treated as compromised until proven otherwise.