MikroTik Routers hijacked by hackers and Redirecting User Traffic to Attackers

MikroTik

MikroTik Routers hijacked by hackers and Redirecting User Traffic to Attackers

MikroTik RouterOS is the operating system of MikroTik RouterBOARD hardware. It can also be installed on a PC and will turn it into a router with all the necessary features – routing, firewall, bandwidth management, wireless access point, backhaul link, hotspot gateway, VPN server and more.

Cyber Criminals compromised around 7,500+ MikroTik Routers and maliciously enables the Socks4 proxy to redirect the legitimate user’s traffic to the malicious website controlled by attackers to perform web mining and other attacks.

At present, totally 239K IPs have confirmed to have Socks4 proxy enabled maliciously and the attacker continuously scanning the MikroTik RouterOS devices with the help of this compromised Socks4 proxy.

Previously Cybercriminals infected over 1,50,000 MikroTik Routers with Coinhive Cryptojacking Campaign using site key to ultimately mining the cryptocurrency.

MikroTik provides hardware and software for Internet connectivity around the world and they also created a RouterOS software.

With this campaign, one single malicious hacker involved in enabling the Socks4 proxy on the victim’s devices and the victim’s count keeps increasing since the attacker continuously working for it.

Earlier attacks on MikroTik routers such as CIA Vault7 hacking tool Chimay Red involves 2 exploits and also another malware has exploited the  MikroTik CVE-2018-14847 vulnerability to perform various malicious activities.

 

 

MikroTik

 

 

How Do MikroTik Routers attack Works

 

Once the attacker enables the Mikrotik RouterOS HTTP proxy by exploiting the vulnerability CVE-2018-14847, then the compromised devices HTTP proxy requests traffic redirect to a local HTTP 403 error page.

This error page contains a link for web mining code from coinhive where attackers perform web mining operation.

Another attack scenario represents that, an attacker enabled the Socks4 port or TCP/4153 on victims device and set the Socks4 proxy config only allows access from one single net-block 95.154.216.128/25.

Attackers mainly targeting Russia, Iran, India, Ukraine, and many more countries. So MikroTik users recommend updating the MikroTik RouterOS software system in a timely manner, and check whether the HTTP proxy, Socks4 proxy, and network traffic capture function are being maliciously exploited by attackers.

 

 

attack

 

 

 

Highest Selling Technical Courses of Indian Cyber Security Solutions:

Certified Ethical Hacker Training in Bhubaneswar

Ethical Hacking Training in Bhubaneswar

Certified Ethical Hacker Training in Bangalore

Ethical Hacking Training in Bangalore

Certified Ethical Hacker Training in Hyderabad

Ethical Hacking Training in Hyderabad

Python Training in Bangalore

Python Training in Hyderabad

Python Training in Bhubaneswar

Microsoft Azure Training in Hyderabad

Microsoft Azure Training in Bangalore

Microsoft Azure Training in Bhubaneswar

Networking Training in Bangalore

Networking Training in Hyderabad

Networking Training in Bhubaneswar

Advance Python Training in Hyderabad

Advance Python Training in Bangalore

Advance Python Training in Bhubaneswar

Amazon Web Services Training in Hyderabad

Amazon Web Services Training in Bangalore

Amazon Web Services Training in Bhubaneswar

Certified Ethical Hacker Certification – C | EH v10

Computer Forensic Training in Kolkata

Summer Training for CSE, IT, BCA & MCA Students 

Network Penetration Testing training

Ethical Hacking  training

Internet Of Things Training

Internet Of Things Training Hyderabad

Internet Of Things Training in Bhubaneswar

Internet Of Things Training in Bangalore

Embedded System Training

Digital Marketing Training

Machine Learning Training

Python Programming training

Android Training in Bangalore

Android Training in Hyderabad

Android Training in Bhubaneswar

Diploma in Network Security Training

Android Development  training

Secured Coding in Java

Certified Network Penetration Tester 

Diploma in Web Application Security 

Certified Web Application Penetration Tester 

Certified Android Penetration Tester 

Certified Python Programming 

Advance Python Training 

Reverse Engineering Training  

Amazon Web Services Training  

VMware Training 

 

Cybersecurity services that can protect your company:

Web Security | Web Penetration Testing

Web Penetration Testing Company in Bangalore

Network Penetration Testing – NPT

Network Penetration Testing Service in Bangalore

Android App Penetration Testing

Source Web Development

Source Code Review

Android App Development

Digital Marketing Consultancy

Data Recovery

 

Other Location for Online Courses:

Bhubaneswar

Bangalore

Hyderabad

 

 

 


Show Buttons
Hide Buttons