7,500 MikroTik routers compromised, traffic forwarded to attackers

Thousands of compromised MikroTik routers are sending traffic to nine attacker-controlled IPs. Researchers from Netlab 360 noticed malware exploiting Mikrotik routers. The same vulnerability was exploited by the CIAs hacking tool Chimay Red. Of the compromised routers, 5,164 devices have their traffic going to this destination. The top five ports being eavesdropped are: 5,837 aimed at port 21 (FTP) and 2,850 targeting port 25 (SMTP) Victims come from 40 countries, but the top 10 countries with compromised routers.”]

Source: https://www.csoonline.com/article/3302774/7500-mikrotik-routers-compromised-traffic-forwarded-to-attackers.html