Loading story…
Infoblox reported a large malspam operation that used about 13,000 compromised MikroTik routers to send malicious email and relay traffic through open SOCKS4 proxies, helping the activity blend in with legitimate network traffic. The campaign impersonated DHL with freight-invoice lures and delivered ZIP archives containing obfuscated JavaScript that launched PowerShell and contacted a malware command-and-control server at 62.133.60[.]137. Researchers said the infrastructure could support not only spam and malware delivery, but also phishing, DDoS, and other covert operations.
A major factor in the campaign’s success was widespread SPF misconfiguration across roughly 20,000 sender domains, especially records that allowed +all, enabling attackers to spoof trusted domains and evade normal email checks. Separate research on MikroTik RouterOS showed that exposed devices remained vulnerable to CVE-2023-30799, a privilege-escalation flaw that can lead to root access on affected hardware, while weak default credentials, username enumeration, and limited brute-force protections reduced the practical value of the authentication barrier. Together, the findings show how insecure router management and weak email authentication created durable infrastructure for a Russian-linked botnet.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
On 2023-07-20, RouterOS 6.49.8 was released, but the write-up states the Long-term branch still lagged on fixes for CVE-2023-30799 until VulnCheck contacted MikroTik.
On 2023-07-19, the MikroTik RouterOS privilege-escalation issue received CVE-2023-30799 after VulnCheck published broader exploitation affecting additional hardware.
On 2023-07-18, VulnCheck said RouterOS Long-term 6.48.6 was the second most installed RouterOS version in Shodan data, with hundreds of thousands of devices exposed through web and Winbox interfaces.
In October 2022, MikroTik fixed the vulnerability later tracked as CVE-2023-30799 in RouterOS stable 6.49.7. The release notes reportedly described it only as improved handling of user policies rather than an explicit security fix.
In June 2022, Margin Research's Ian Dupont and Harrison Green publicly presented the FOISted exploit for MikroTik RouterOS x86 VM, demonstrating root-shell access without a CVE assignment at that time.
Through email header analysis, Infoblox determined that approximately 13,000 compromised MikroTik devices were participating in the botnet and proxying malicious traffic through unauthenticated SOCKS4 relays.
Infoblox reported that the botnet abused roughly 20,000 sender domains with dangerous SPF records permitting "+all," allowing spoofed emails to bypass normal protections and improve delivery.
In late November, Infoblox discovered a large malspam operation using compromised MikroTik routers as open SOCKS4 relays to send DHL-themed freight invoice lures carrying malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and private-sector partners disrupted an **APT28** campaign known as **FrostArmada** that hijacked DNS traffic on compromised SOHO routers to steal Microsoft 365 credentials and OAuth tokens. Investigators said the operation abused **MikroTik**, **TP-Link**, some **Nethesis**, and older **Fortinet** devices, redirecting authentication traffic through attacker-controlled VPS infrastructure to perform adversary-in-the-middle interception. Microsoft and Lumen Black Lotus Labs traced the activity, identified victims, and supported action by the **FBI**, the **U.S. Department of Justice**, and Polish authorities to take malicious infrastructure offline. At its peak in December 2025, the campaign had infected about **18,000 devices in 120 countries** and affected government agencies, law enforcement, IT and hosting providers, and organizations running their own servers. The disruption comes amid broader warnings that Russia-linked **Fancy Bear**—also tracked as **APT28**, **Forest Blizzard**, and **Pawn Storm**—continues global cyber-espionage and disruptive operations. Recent reporting tied the group not only to router-based DNS hijacking, including abuse of TP-Link devices and exploitation of **`CVE-2023-50224`**, but also to **NTLMv2** hash relay attacks leveraging Outlook flaw **`CVE-2023-23397`** and malware activity targeting Ukraine’s defense supply chain and allied countries. Security guidance from Microsoft, the UK NCSC, researchers, and government agencies urged organizations to harden routers, patch internet-facing systems, enable MFA, reduce external exposure, remove end-of-life equipment, and adopt certificate pinning and zero-trust controls to limit credential theft and follow-on compromise.
Jun 29, 2026
A joint advisory from cybersecurity agencies in 12 countries warned that Russian state hackers linked to **FSB Center 16** are actively targeting vulnerable routers worldwide, focusing on devices exposed with default or weak SNMP credentials and community strings. The agencies said the actors can abuse SNMP to copy router configurations through OIDs and exfiltrate them over TFTP, while also exploiting older network-device flaws such as `CVE-2018-0171` on Cisco equipment. High-risk sectors identified in the warning include communications, defence, energy, financial services, government, and healthcare, and the activity follows formal UK and EU attribution of cyber-attacks on Poland’s energy infrastructure to the same Russian service. Separate reporting highlighted how compromised SOHO and home-office routers can be used for **DNS hijacking** that bypasses endpoint security and enables credential theft against remote workers. The attack path described combines documented Russian tradecraft, including APT28-linked router compromises, with downstream abuse such as redirecting traffic, harvesting **NTLMv2** hashes, and stealing Microsoft 365 credentials and tokens. Defenders were urged to harden or replace poorly secured routers, move to **SNMPv3**, disable unnecessary exposed services, monitor for unauthorized DNS resolver changes and NXDOMAIN spikes, and factory-reset suspected devices before rotating affected credentials.
Aug 15, 2026
Researchers and mitigation providers tied the **Mēris** botnet to large-scale compromise of **MikroTik** routers, primarily through `CVE-2018-14847`, brute-forced SSH access, and abuse of RouterOS features such as scheduled tasks and **SOCKS proxy** enablement. Solar JSOC CERT linked the infection chain to infrastructure and techniques associated with **Glupteba**, identified about **95,500** unique compromised MikroTik devices from exfiltrated configuration data, and sinkholed `cosmosentry[.]com`, receiving traffic from roughly **45,000** infected devices over six days. Cloudflare separately described Mēris as a highly active Layer 7 botnet that used **HTTP pipelining** and open proxies to generate massive throughput, including attacks reaching **17.2 million requests per second** and averaging more than 100 attacks per day. The botnet was also used in **DDoS extortion** campaigns that embedded ransom notes directly in HTTP request URLs, with messages claiming to be from **REvil** and demanding **1 bitcoin per day** while threatening reputational and financial harm. Imperva said one victim site was hit with a peak of **2.5 million requests per second**, with more than **12 million** malicious requests carrying an embedded extortion message and over **64 million** requests blocked in under a minute. The activity followed earlier record-setting Mēris operations, including the **21.8 million RPS** attack disclosed by Yandex, and targeted organizations in the United States and Europe, especially business, communications, and financial-sector sites.
Aug 15, 2026