Cybercriminals have compromised around 7,500+ MikroTik Routers and maliciously enables the Socks4 proxy to redirect the legitimate users traffic to the malicious website controlled by attackers to perform web mining and other attacks. At present, a total of 239K IPs have confirmed to have Sock4 proxy enabled maliciously and the attacker continuously scanning the Mikrotik RouterOS devices with the help of this compromised proxy. The attacker using this technique in order to gain control even after users device reboot the device.”]
Source: https://gbhackers.com/7500-mikrotik-routers-hijacked/