{"id":90774,"date":"2018-08-07T17:46:45","date_gmt":"2018-08-08T00:46:45","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=90774"},"modified":"2025-08-30T03:33:05","modified_gmt":"2025-08-30T10:33:05","slug":"cryptojacking-campaign-mikrotik-routers","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/cryptojacking-campaign-mikrotik-routers\/","title":{"rendered":"Cryptojacking Campaign Caught Targeting Over 200,000 MikroTik Routers"},"content":{"rendered":"

Our routers are our connection to the internet, allowing us to use our devices to access websites at our leisure. And because of this, routers are often a target for hackers. In fact, just this week, it was uncovered<\/a> that MikroTik is the latest router manufacturer under siege, as researchers have discovered a massive Coinhive cryptojacking campaign that\u2019s targeting<\/a> MikroTik routers.<\/p>\n

The attack<\/a>\u00a0first finds its footing by taking advantage of a vulnerability within MikroTik routers. Once it leverages the flaw, the attack changes the devices\u2019 configuration to inject Coinhive cryptocurrency mining malware into users’ web traffic. For context, Coinhive is a cryptocurrency mining service. Set up as a legitimate service, Coinhive is unfortunately often used<\/a> by cybercriminals to hack websites and cryptojack users, aka steal the processing power<\/a> of their devices to mine for cryptocurrency without their consent.<\/p>\n

Which is precisely what\u2019s happening to over 200,000 MikroTik customers, largely in Latin America. However, the attack has the potential to start spreading all over the world, given there are 1.7 million MikroTik routers all over.<\/p>\n

Proactive Security Tips<\/h2>\n

Now, the next question is \u2013 what can these MikroTik users do to protect themselves from this attack? Start by following these proactive security tips:<\/p>\n