MikroTik routers can be taken over without a password: check the router at your Mexico site or branch today

On September 23, 2026, researchers disclosed an attack chain against MikroTik routers, nicknamed MikroTrick, that lets an attacker take full control of the device with no password and no SSH key, as reported by The Hacker News. The same day, BleepingComputer covered the InfraTrust report, which warns that network management systems are actively under attack.

Why this lands on your desk: MikroTik is the most common router in Mexican SMBs, branch offices and local internet providers. If your plant in Querétaro or your store in Guadalajara was connected by a local ISP or a contractor before your team got involved, there is a good chance a MikroTik sits at the edge, and nobody at headquarters has ever logged into it. There is no confirmed mass exploitation yet. That is exactly the window you want to use.

How to tell if your Mexico site runs a MikroTik

Ask whoever set up the site whether the router is managed with a program called Winbox, a small window with many tabs. If yes, it is MikroTik. If the browser panel says WebFig, same thing. RouterOS is the operating system on these routers, and that is where the flaw lives.

In our experience the usual answer from a Mexico site is that the internet guy installed it. The router works, still has the factory admin user, and appears in no inventory. That orphan device is the one that worries us most.

What to do today, in this order

1. Update RouterOS to the latest stable release, from the System menu and then Packages. Do it after hours: the router reboots and the site loses internet for a few minutes.
2. Change the admin password. If admin still has no password, or the one printed on the label, set a long one now. Better still, create a user with a different name and disable admin.
3. Close management to the internet. Winbox, WebFig and the API should only answer from inside the local network.

Service	Usual port	What to do
Winbox	8291	LAN only, or over VPN
WebFig (web panel)	80 and 443	LAN only, or over VPN
API	8728 and 8729	Disable if nobody uses it
Telnet and FTP	23 and 21	Disable
SSH	22	VPN only, with a key

Manage it over VPN, not from the open internet

When your IT manager in Dallas or Madrid needs to reach the router in Mérida, the right door is a VPN: an encrypted tunnel that puts you inside the network of the site. Once inside, open Winbox as usual.

What should never happen is Winbox answering anyone who scans the public IP of the site. It is the same rule we apply to exposed IP cameras and to the Zyxel firewall: whatever manages your network does not face the street.

Signs it has already been taken

Before patching, check these. If the router is already compromised, a patch does not evict the intruder.

• Changed DNS. Under IP and then DNS you find servers you never set. It is the favorite trick: they redirect the traffic of the whole site wherever they want.
• Odd rules. NAT or firewall entries nobody recognizes, or scripts scheduled under System and then Scheduler.
• New users under System and then Users, or an admin account that no longer accepts your password.
• Unusual outbound traffic, especially at night when the site is empty.
• A proxy or VPN tunnel you did not configure.

Let’s talk

And at your Mexico operation?

One site and one router: an afternoon of work. Eight branches, each with a router installed by a different local provider: you need an inventory, a plan, and someone in Mexico who can reach the device when remote access fails.

At ProcessBi we run a remote review of the router the same day: firmware version, exposed services, DNS and rules. Hardening, network segmentation and, if the device is too old, replacement are covered under the support plan. When the router sits in a warehouse with no IT staff, we send a technician: field service across all of Mexico, reporting in English to your team.

Ask for a router review — we reply the same business day.