Critical MikroTik RouterOS Vulnerability Exposes Networks to Remote Code Execution On September 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) disclosed a severe vulnerability in MikroTik RouterOS, tracked as CVE-2026-84411, with a CVSS score of 9.8. The flaw, an integer underflow (wraparound), affects versions earlier than 7.24 and could allow unauthenticated remote attackers to execute arbitrary code or trigger a denial-of-service (DoS) condition on vulnerable devices. Exploitation could lead to full device compromise, enabling threat actors to pivot across networks, intercept traffic, or maintain persistent access posing significant risks to enterprises, service providers, and industrial environments where MikroTik routers are widely deployed. The vulnerability stems from improper arithmetic handling, where an integer value wraps to an unexpectedly large number, potentially causing memory corruption or faulty processing paths. While CISA reported no confirmed public exploitation at the time of disclosure, the critical nature of the flaw makes it a prime target for botnets, ransomware groups, and initial-access brokers, particularly as internet-facing devices are routinely scanned post-disclosure. Affected organizations are urged to upgrade to RouterOS 7.24 or later, prioritizing devices with exposed management interfaces or privileged network access. Security teams should monitor for suspicious activity and preserve logs for incident response. The flaw impacts global communications and IT infrastructure, underscoring the urgency of mitigation.

Cybersecurity Roundup: Zero-Days, AI-Driven Attacks, and Major Breaches Dominate the Week This week’s cybersecurity landscape was marked by a surge in critical vulnerabilities, active exploitation campaigns, and high-profile breaches highlighting persistent threats to enterprises, governments, and consumers. ### Microsoft’s Record-Breaking Patch Tuesday Microsoft’s September 2026 Patch Tuesday addressed 973 vulnerabilities, the largest single release in its history. The update spanned Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools, with 438 elevation-of-privilege flaws and 258 remote code execution (RCE) bugs. Notably, 64 vulnerabilities were tied to the Windows Biometric Service, suggesting systemic weaknesses in authentication. Two zero-days under active exploitation were patched: - CVE-2026-85880 (Windows ALPC) – Elevation-of-privilege flaw. - CVE-2026-81963 (Windows Update Stack) – Also an elevation-of-privilege bug. Critical fixes were also issued for Windows Secure Kernel Mode, VBS Enclave, and Excel/Word RCE flaws, making this one of the most urgent patch cycles of the year for enterprise IT teams. ### Fortinet Under Fire: Active Exploitation and Critical Flaws Security researchers uncovered an active campaign exploiting CVE-2025-25249, a 9.8-rated heap overflow in FortiOS and FortiSwitchManager’s CAPWAP service. Attackers deployed PivotC2, a custom Node.js RAT that bypasses firewalls via outbound TLS connections, harvests device configurations, and decrypts VPN credentials. - 30,000 FortiGate IPs scanned, with 178 devices compromised. - U.S. organizations targeted, with Exchange mailbox data exfiltrated to Wasabi cloud storage. - A Russian-speaking, financially motivated group is suspected, also exploiting FortiManager and ArubaOS flaws. Fortinet also disclosed CVE-2026-84393, a 7.3-rated certificate validation flaw in FortiOS and FortiProxy’s Agentless ZTNA portal, allowing man-in-the-middle attacks on internet-facing portals. No in-the-wild exploitation has been observed, but upgrades to FortiOS 7.6.7+ are strongly recommended. ### Palo Alto Networks PAN-OS RCE Flaw Palo Alto Networks revealed CVE-2026-0310, a 9.2-rated buffer overflow in PAN-OS XML processing that enables root-level RCE on PA-Series firewalls. While exploitation complexity is high, VM-Series firewalls face only a denial-of-service impact. - No workaround exists upgrades to PAN-OS 12.2.3+ are required. - The flaw was discovered internally; no exploitation has been reported. ### AI-Powered Cyberattacks: A New Threat Frontier Anthropic’s Threat Intelligence team reported that state-sponsored groups and cybercriminals are weaponizing Claude AI to automate attack chains: - A Russian-linked group (GTG-20006) used Claude to rewrite malware upon detection, hijack hotel Wi-Fi for phishing, and steal 300,000 national ID records from a North African government. - ShinyHunters scaled credential harvesting across 10 cloud workers, decompiling 1.8 million Android apps for hardcoded secrets. - A suspected Chinese exploit foundry (GTG-10007) generated over a dozen zero-day candidates in a single month using AI agent swarms. ### Major Breaches: Revolut, Odido, and More - Revolut disclosed a KYC data breach after attackers impersonated a government agency via a fraudulent email under an official domain. Exposed data included passports, driver’s licenses, transaction histories, and Bitcoin activity. - Odido (Dutch telecom) suffered a 6.39 million-record breach after a vishing attack a Dutch-speaking caller impersonated an IT colleague to obtain credentials, then exfiltrated 90 GB of data via Salesforce APIs. The data was later leaked after a €1 million ransom demand was refused. - ShinyHunters was linked to the attack, using identical tactics against 100+ organizations, including SoundCloud and Betterment. ### Zero-Days and Emerging Threats - PostGREShell (CVE-2026-6471): A 12-year-old PostgreSQL flaw allows low-privileged accounts to execute code via shared libraries. Patches are available in PostgreSQL 18.6+. - StyleSmuggler: An unpatched Magento/Adobe Commerce zero-day lets attackers execute malicious PHP via email templates. No official fix exists; hardening patches are recommended. - WeWorm: A zero-click WeChat VoIP exploit demonstrated cross-platform worming between iOS and Android, granting full account control. - BlueMoon Exploit Kit: Chains Chromium V8 and Windows ALPC flaws to deploy backdoors against government and defense targets, with China-linked groups adopting it within days. ### Enterprise and Consumer Risks - LG OLED TVs were found scanning home networks and recording audio even in standby mode, raising concerns for hospitals, hotels, and corporate environments. - MikroTik RouterOS suffered an unauthenticated SSH flaw, leading to unauthorized shell access on exposed devices. - Check Point VPN flaws (CVE-2026-85102/85103) enable unauthenticated RCE on Quantum Security Gateways. - Google Chrome 153 patched 230 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-87491). ### Government and Infrastructure Shifts - Switzerland’s Federal Council is piloting an open-source digital workplace to reduce reliance on Microsoft 365, aiming for 3,000 employees by 2027. - Windows Server RDP freezes were reported after September updates, creating a security vs. stability dilemma for enterprises. ### Key Takeaways This week underscored the growing sophistication of cyber threats, from AI-driven attacks to zero-day exploitation and social engineering breaches. Organizations must prioritize patch management, credential security, and AI threat monitoring to mitigate risks in an increasingly complex threat landscape.

MikroTik Routers Under Active Exploitation via SSH Flaw On September 5, CERT Polska issued a warning about attackers exploiting MikroTik routers with exposed SSH services to gain full administrative control without authentication. The campaign, dubbed MikroTrick, has been active since at least September 2, though the exact number of victims and attacker identities remain unknown. The vulnerability affects multiple RouterOS versions, with fixes released in the following updates: - 6.x: 6.49.21 (for versions below 6.49.21) - 7.x: 7.23.4 (for versions below 7.23.4) and 7.24.2 (for versions below 7.24.2) - Development: 7.25beta3 (for unlisted versions) A regression fix (7.23.5) was later issued to address an IPv6 DHCP issue introduced in 7.23.4 while maintaining security patches. CERT recommends immediate updates and advises temporarily disabling exposed services (SSH, WWW/WWW-SSL, bandwidth-test) or restricting access to trusted networks until patches are applied. MikroTik’s default firewall blocks public access to management ports on home devices, but compromised configurations may still be at risk. Post-update, administrators should check logs for unauthorized changes, including unexpected privileged accounts (e.g., `ssh:-2@`) or suspicious scripts. If compromise is detected, CERT advises isolating the router, preserving logs, and performing a factory reset avoiding full backups from the compromised device. Passwords, keys, and other secrets should be rotated as part of recovery. The exact vulnerabilities chained in the attack remain undisclosed, and it is unclear whether the flaws were zero-days before fixes were released. MikroTik and CERT Polska have not yet provided further details.

Russian APT28 Exploits Vulnerable Routers in Large-Scale Credential Theft Campaign The UK’s National Cyber Security Centre (NCSC) has issued a warning about two ongoing cyberespionage campaigns by the Russian hacking group APT28 (also known as Fancy Bear, Forest Blizzard, and Sofacy), which is linked to Russia’s GRU military intelligence unit. Since early 2024, APT28 has been hijacking vulnerable internet routers particularly TP-Link models to redirect traffic through attacker-controlled servers and steal credentials from targeted organizations. ### How the Attack Works APT28 has repurposed virtual private servers (VPS) as malicious DNS servers, intercepting high volumes of DNS requests from compromised routers. The group employs an opportunistic approach, initially casting a wide net to identify potential victims before narrowing down targets of intelligence value. In one campaign, APT28 exploited CVE-2023-50224, a vulnerability in TP-Link WR841N routers that allows unauthenticated attackers to extract credentials via crafted HTTP requests. By altering the DHCP DNS settings on these routers, the group forced downstream devices (such as laptops and phones) to resolve requests through their malicious servers. This enabled adversary-in-the-middle (AitM) attacks, allowing APT28 to harvest passwords, OAuth tokens, and other credentials from web and email services. Microsoft Threat Intelligence further reported that APT28 and its sub-group Storm-2754 have been compromising SOHO routers since at least August 2023, expanding their infrastructure to facilitate these attacks. ### Impact and Attribution The NCSC assesses that APT28’s operations are highly targeted, focusing on entities of strategic interest to Russian intelligence. While the initial router compromises appear broad, the group refines its focus at later stages to prioritize high-value victims. The stolen credentials could enable further unauthorized access, though the exact scope of follow-on attacks remains unclear. This campaign underscores the persistent threat posed by state-backed cyber actors leveraging common vulnerabilities in consumer-grade networking devices to conduct large-scale espionage.

FancyBear’s Major OpSec Blunder Exposes Espionage Campaign Targeting European Governments and NATO In a rare operational security failure, Russian state-linked hacking group FancyBear (APT28/Forest Blizzard/GRU Unit 26165) inadvertently exposed a long-running cyberespionage campaign after leaving a server unsecured for over 500 days. The breach, first detected by threat intelligence firm Hunt.io on January 13, 2026, and later analyzed by Ctrl-Alt-Intel, provided researchers with unprecedented visibility into Operation Roundish, an active campaign targeting government and military entities across Europe. The exposed server a NameCheap Virtual Private Server (VPS) hosted in the U.S. at IP 203.161.50.145 had been previously attributed to FancyBear by Ukraine’s CERT-UA in September 2024, yet the group continued using it without interruption. The open directory contained 2,800 exfiltrated government and military emails, 240 stolen credentials (including passwords and TOTP 2FA secrets), 140 silent email-forwarding rules, and 11,500 harvested contact addresses from victims in Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. Notably, the stolen data included email addresses tied to four NATO member states, including NATO’s own headquarters infrastructure. A second exposed directory, discovered by Ctrl-Alt-Intel, revealed even more sensitive material: FancyBear’s full command-and-control (C2) source code, additional JavaScript payloads, campaign telemetry logs, and further exfiltrated data. The targeting pattern aligned with geopolitical priorities, with Ukraine’s regional prosecutors (likely linked to war crimes investigations) as the largest victim group. Other high-profile targets included Romania’s Air Force, Greece’s National Defence General Staff, Serbia’s Ministry of Defence, and Bulgarian government entities all nations involved in recent military cooperation, such as Greece’s training of Ukrainian F-16 pilots and a 2024 military mobility agreement between Romania, Bulgaria, and Greece. The most alarming technical aspect of the campaign was FancyBear’s method for silently bypassing 2FA. Using a JavaScript module (keyTwoAuth.js), the group exploited a Roundcube webmail XSS vulnerability to extract TOTP secrets and recovery codes from authenticated sessions without victim interaction. The module parsed the twofactorgauthenticator plugin settings, encoded the stolen data, and exfiltrated it to the group’s C2 server (zhblz.com) under the log prefix ktfu. Researchers recovered 516 log entries from 108 unique victim addresses, with 256 accounts having their TOTP secrets compromised including targets at Romania’s Air Force, Greece’s GEETHA, Ukraine’s Asset Recovery Agency, and Serbia’s Ministry of Defence. The remaining 260 accounts had no 2FA enabled, making them trivial to access. The exposure underscores the group’s persistent reliance on known infrastructure despite prior attribution, as well as the sophistication of its 2FA bypass techniques. While the incident provides defenders with critical intelligence, it also highlights the ongoing threat posed by FancyBear to NATO-aligned governments and military organizations.

Russian GRU-Linked Hackers Exploit Routers in Global Credential Theft Campaign The U.K.’s National Cyber Security Centre (NCSC) has issued a warning about a sophisticated cyber espionage campaign conducted by APT28, a hacking group tied to Russia’s GRU military intelligence agency. The attackers are compromising widely used internet routers primarily from manufacturers MikroTik and TP-Link to intercept and redirect traffic through malicious servers under their control. By altering router settings, the hackers gain the ability to steal passwords, manipulate data, and expand access to targeted networks. The NCSC’s alert highlights the risks of credential theft and broader system compromise, though neither MikroTik nor TP-Link has publicly responded to the findings. Paul Chichester, the NCSC’s Director of Operations, emphasized that the campaign exploits vulnerabilities in common networking hardware, underscoring the threat posed by state-backed actors targeting critical infrastructure. Parallel research from Lumen Technologies’ Black Lotus Labs revealed the campaign’s global scale, identifying thousands of potential victims across at least 120 countries. Primary targets included government agencies such as foreign ministries and law enforcement as well as third-party email providers. The incident reflects growing international concern over router security. In a related move, the U.S. Federal Communications Commission (FCC) recently banned the sale of certain foreign-made consumer routers, citing supply-chain vulnerabilities that could enable large-scale disruptions to critical infrastructure. The NCSC and Lumen’s findings provide technical guidance for mitigating such attacks, though the full scope of the campaign’s impact remains under investigation.