Overview
A massive botnet comprising 13,000 compromised MikroTik routers has been discovered launching sophisticated malspam campaigns. The operation, codenamed Mikro Typo, exploits misconfigured DNS records and SPF vulnerabilities across 20,000 domains
Whom it may concern
- Network administrators managing MikroTik infrastructure
- Security teams responsible for email protection
- Organizations using potentially affected domains
- DNS security administrators
Key Findings
- Botnet leverages unauthenticated SOCKS proxies enabling anonymous attack traffic
- Exploitation of CVE-2023-30799 for privilege escalation and code execution
- Permissive SPF records ('+all') allowing email spoofing
- Multiple attack vectors including DDoS, phishing, and malware distribution
Risk Analysis
- Probability: High (13,000 compromised devices)
- Impact: Critical (affects 20,000 domains)
- Attack Surface: Global network infrastructure
- Exploitation Complexity: Low (no authentication required)
Action Items
- Update MikroTik firmware immediately
- Audit and correct SPF records
- Implement authentication for SOCKS proxies
- Monitor for suspicious email traffic
- Deploy additional email security controls
Sources
- [The Hacker News](https://thehackernews.com/2025/01/13000-mikrotik-routers-hijacked-by.html)
- Infoblox Security Research (Technical Report, January 2025)
