What makes the infection of MikroTik routers so significant is that they are used by millions of homes and organizations worldwide. Once it had expanded its reach to networking devices, Trickbot began infecting MikroTik routers and modules and using them as proxy servers for its C2 servers and redirecting router traffic through alternative non-standard ports. Trickbot, as it has grown and evolved, now includes a plug-in for backdoor access for Ryuk, a piece of ransomware with crypto-mining capabilities. Malware is particularly dangerous because it can be ransomware, a special type of malware that takes control over your computer or devices. Why is the MikroTik security flaw important? Since Trickbot continuously improves its persistence capabilities by dodging researchers and their reverse engineering attempts, it has been able to maintain the stability of its command-and-control (C2) framework. As a result, Trickbot has proven to be an adaptable, sophisticated trojan of modular nature, molding itself for different networks, environments, and devices.Īs Trickbot has evolved, it began to reach Internet of Things (IoT) devices like routers. One of the main reasons for Trickbot’s persistence is that it has continued to change and evolve over the years.

Trickbot was first discovered in 2016 and, despite efforts by Microsoft to stamp it out, has continued to remain a threat online. This article will introduce some background on the MikroTik vulnerability, the Trickbot malware, and some ways you can protect yourself. It is designed to analyze routers for Indicators of Compromise (IoCs) associated with Trickbot.

The tool, RouterOS Scanner, has its source code available on GitHub. In mid-March, Microsoft released a free, open-source tool that can be used to secure MikroTik routers.

This blog was written by an independent guest blogger.

Mikrotik router firewall