Hunting MikroTrick: Log Indicators and Forensic Checks for the RouterOS Chain

Vulnerability overview

CVE-2026-67279 and CVE-2026-86060 give defenders something unusual for a serious router bug: a visible trail. The MikroTrick chain, documented by CERT Polska and fixed in MikroTik's 3 September 2026 RouterOS releases, leaves log entries that should never appear on a healthy device. This article focuses on the detection side, because the exploit was already seen in the wild before fixes shipped and a patched device can still be a compromised one.

Mechanism and exploitation conditions

The chain has two stages. First, the SSH server mishandles a rekey performed during authentication and advances to the channel phase without an authenticated identity. Second, the login helper reads a username beginning with a hyphen as an option, so the value -2 redirects it to descriptor 2 and lets the client supply both the account name and the effective policy mask.

The important point for defenders is what the technique cannot avoid. Reaching stage two requires the SSH negotiation and rekey exchange to take place, and the attack identifies itself as a user that does not exist. The published campaign logs show two entries in sequence: a failed login for user -2, and then the creation of an ops account. Seeing one without the other still warrants attention; seeing both on the same host is close to conclusive.

Impact

A successful chain yields the RouterOS administrative console with full policy. On a perimeter router that means the attacker can alter routing and firewall behaviour, expose internal networks, harvest VPN keys and certificates, and create accounts for later use. The observed activity included exporting a device diagnostic file to an external address, which suggests the goal extended past access and into information collection.

Affected products and scope

All RouterOS branches listed in the September 2026 fixes are in scope: 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. Devices that were internet-facing before that date should be reviewed even if they are now updated. The relevant question is not whether the device is patched today but whether it was reachable and unpatched while exploitation was underway.

ZoomEye measurement for this topic used os="RouterOS" && service="ssh" and returned 9,559 devices, an indicator of how many RouterOS management listeners remain observable from the public internet.

Remediation and mitigations

Patching is necessary and not sufficient. A practical hunting checklist follows.

• Search SSH logs for authentication attempts using usernames that start with a hyphen. A failure for -2 is the signature of the injection attempt.
• Enumerate accounts on every RouterOS device. An ops account with full policy that you did not create is a compromise indicator, not a curiosity.
• Inspect the firmware's Flagged status, which the hardened release applies to suspicious privileged accounts.
• Look for outbound fetch activity or unexpected file transfers to unfamiliar hosts, particularly of diagnostic or configuration exports.
• Review routing, firewall, NAT and tunnel configuration for changes you cannot attribute to a documented maintenance window.
• Rotate credentials, certificates and tunnel keys on any device with positive findings, and re-check management access rules.

The last point is where many investigations stall. Credentials that passed through a compromised router should be treated as disclosed, whatever the logs say about how long the attacker was present.

References

• CERT Polska, "MikroTrick: technical analysis, disclosure process and use of LLM agents" - https://cert.pl/posts/2026/09/mikrotrick-analiza-techniczna/
• MikroTik RouterOS security release notes, September 2026
• CISA Known Exploited Vulnerabilities catalog
• RFC 4252 and RFC 4254 (SSH authentication and connection protocols)