[GTER] FYI: 7,500+ MikroTik Routers Are Forwarding Owners’ Traffic to the Attackers, How is Yours?

[Henrique de Moraes Holschuh]

Artigo relevante para a Internet Brasileira:

https://blog.netlab.360.com/7500-mikrotik-routers-are-forwarding-owners-traffic-to-the-attackers-how-is-yours-en/

"Since Mid-July, our Anglerfish Honeypot System has been picking up
malware exploiting the above MikroTik CVE-2018-14847 vulnerability to
perform various malicious activities. Some of the activity has been
spotted by other security researchers such as CoinHive mining code
injecting.

What’s more, we have observed massive number of victims having their
Socks4 proxy enabled on the device by one single malicious actor.

More interestingly, we also discovered that more than 7,500+ victims are
being actively eavesdropped, with their traffic being forwarded to IPs
controlled by unknown attackers."

Leiam o artigo para maiores detalhes.  O Brasil é o *mais* afetado.

-- 
  Henrique Holschuh