Most of the 7,500 victims are in Russia, the firm found and in terms of the collecting IP addresses, 37.1.207.114 is the top player among all the attackers. “Why are the attackers paying attention to the network management protocol regular users barely use? Are they trying to monitor and capture some special users’ network snmp community strings? We don’t have an answer at this point, but we would be very interested to know what the answer might be.” “This deserves some questions,” the researchers pointed out. Also, oddly, snmp port 161 and 162 are also under surveillance. “The MikroTik RouterOS device allows users to capture packets on the router and forward the captured network traffic to the specified Stream server,” the researchers explained, in a post on Tuesday, adding that attackers are listening to ports 20, 21, 25, 110 and 143, corresponding to FTP-data, FTP, SMTP, POP3 and IMAP traffic. Out of those, about 31 percent, or 370,000, are vulnerable to the flaw. In fact, as of August 24, the 360 Netlab honeypot network had picked up on more than 5 million devices with an open TCP/8291 port worldwide, of which 1.2 million are MikroTik devices.

The flaw is a Winbox Any Directory File that allows bad actors to read files that flow through the router without authentication while MikroTik patched it in early August, many users have yet to update, leaving a large attack surface open. RouterOS powers the business-grade RouterBOARD brand, as well as ISP/carrier-grade gear from the vendor.

This means the bad actors can gain access to any of the files or data being passed by the router to and from corporate networks.Īccording to security researchers at 360 Netlab, adversaries are exploiting the known MikroTik CVE-2018-14847 vulnerability in Winbox, which is a management component and a Windows GUI application for MikroTik’s RouterOS software. A full 7,500+ MikroTik routers are forwarding their owners’ traffic to eavesdropping cybercriminals – while 239,000 more have had their Socks4 proxy enabled, maliciously and surreptitiously.

Mikrotik routeros uses