network security2 articles
MikroTik Routers Being Hijacked Over SSH With Zero Authentication Required
Attackers have been exploiting internet-exposed SSH services on MikroTik routers since at least September 2, gaining full administrative control without authentication through a two-vulnerability chain dubbed "MikroTrick" by CERT Polska. Affected devices run RouterOS versions across the 6.x, 7.x, and development channels, with fixes available in releases 6.49.21, 7.23.4/7.23.5, 7.24.2, and 7.25beta3. Users are urged to install updates immediately, check for signs of compromise such as unknown accounts or suspicious logs, and temporarily restrict access to exposed services until patching is complete.
Fire Ant Goes Deeper: China-Linked Hackers Hit Cisco Routers, TACACS Servers and Linux Hosts
A China-linked cyber espionage group called Fire Ant (strongly overlapping with UNC3886) has expanded its campaign to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, turning them into credential-harvesting and network surveillance platforms. The attackers deployed custom malware to capture network traffic, steal authentication credentials via a novel library-injection technique, and actively suppress logs, security telemetry, and audit records to hinder detection and forensic investigation. The activity mirrors tactics attributed to Salt Typhoon in a separate CISA advisory, highlighting a broader Chinese espionage trend of targeting network infrastructure devices to gain persistent, privileged visibility into high-value networks.