CuraSec

tag: Router-Security · 4 items

Act archived Hackers Exploit MikroTik RouterOS Flaw Chain to Hijack Routers via SSH
2026-09-07 · BleepingComputer · source ↗ #mikrotik#router-security#active-exploitation
  • Engineer — Act: Active exploitation of a chained vulnerability pair targeting MikroTik RouterOS devices with SSH exposed to the internet; patch RouterOS to the latest stable release immediately and restrict SSH access to trusted management IPs via firewall rules.
  • SOC/IR — Act: Router hijacking via exposed SSH is an assume-breach scenario for any MikroTik devices in the estate; sweep SSH auth logs on edge devices for anomalous logins, and hunt for lateral movement originating from RouterOS management interfaces since disclosure.
  • Leader — Plan: Actively exploited edge-device flaws can expose the entire network perimeter; confirm whether MikroTik equipment is present in the environment and verify the engineering team has a patch plan for exposed devices this week.
Plan archived Evooo1Bot Linux botnet hijacks routers as SOCKS5 relay nodes
2026-08-16 · BleepingComputer · source ↗ #botnet#linux#router-security
  • Engineer — Plan: Audit internet-facing gateway devices and routers for signs of Mirai-variant compromise; harden by restricting management interfaces, disabling unused services, and ensuring firmware is current — no active KEV or PoC signals yet to force immediate action.
  • SOC/IR — Plan: Build or tune detections for anomalous SOCKS5 proxy traffic originating from edge/gateway devices; hunt for unexpected outbound relay behavior on routers in your estate since no specific IOCs are currently published.
  • Leader — Skip
Learn archived Zbtlink Routers Ship With Factory Backdoor Enabling Unauthenticated Root Shells
2026-08-06 · The Hacker News · source ↗ #hardware-backdoor#supply-chain#router-security
  • Engineer — Learn: Zbtlink is a niche brand unlikely to appear in enterprise infrastructure, and no enrichment signals indicate active exploitation; however, the finding that backdoors persist across 2+ years of firmware images is a useful supply-chain sourcing reminder when evaluating network hardware vendors.
  • SOC/IR — Learn: No IOCs or ATT&CK-mapped TTPs are available from the summary, and Zbtlink hardware is uncommon in enterprise estates, so there is no immediate hunt or detection to build; worth noting the beaconing behavior pattern if these devices ever appear in an asset inventory.
  • Leader — Learn: This reinforces hardware supply-chain risk from certain manufacturers but is not a systemic enterprise event; useful context for a future board conversation on network equipment sourcing standards, but no same-week action is warranted.
Plan archived US and allies warn of Russian state hackers targeting routers
2026-07-13 · BleepingComputer · source ↗ #russian-apt#critical-infrastructure#router-security
  • Engineer — Plan: The advisory targets vulnerable and misconfigured routers — audit your edge router configurations against the joint advisory’s hardening guidance and prioritize patching any unmanaged or end-of-life devices on the network perimeter this quarter.
  • SOC/IR — Plan: A nine-nation joint advisory signals a documented campaign with TTPs worth operationalizing; pull the full advisory for any ATT&CK mappings and IOCs and build or tune detections for lateral movement originating from router-adjacent network segments.
  • Leader — Plan: A coordinated advisory from nine countries on Russian state targeting of critical infrastructure raises the threat posture for the quarter — assess whether your sector is named in the advisory and prepare a brief for leadership on edge-device exposure and any vendor dependencies in that space.