Re: Mirai botnet is back — now as "Meris"

[Mike Hammett <nanog () ics-il net>]

Mikrotik is a very popular router in small to medium ISPs, running, well, everything. 




----- 
Mike Hammett 
Intelligent Computing Solutions 
http://www.ics-il.com 

Midwest-IX 
http://www.midwest-ix.com 

----- Original Message -----

From: "Töma Gavrichenkov" <ximaera () gmail com> 
To: "NANOG" <nanog () nanog org> 
Sent: Thursday, September 9, 2021 4:41:03 AM 
Subject: Mirai botnet is back — now as "Meris" 

Peace, 

An undisclosed (or, even, yet undiscovered by the vendor) 
vulnerability in SOHO Mikrotik routers seems to be exploited by 
someone. 
Approx. 328 thousand devices already joined the botnet, with each 
having unrestricted access to the uplink (up to 1 Gbps). 42,6% of 
exploited devices reside in the U.S. 

https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/ 

I didn't know Mikrotik was so popular in North America! 
Patching all those SOHO WiFi routers must be fun... 

-- 
Töma