Re: Mirai botnet is back — now as "Meris"

Thu Sep 9 12:31:52 UTC 2021

Mikrotik is a very popular router in small to medium ISPs, running, well, everything. 

----- 
Mike Hammett 
Intelligent Computing Solutions 
http://www.ics-il.com 

Midwest-IX 
http://www.midwest-ix.com 

----- Original Message -----

From: "Töma Gavrichenkov" <ximaera at gmail.com> 
To: "NANOG" <nanog at nanog.org> 
Sent: Thursday, September 9, 2021 4:41:03 AM 
Subject: Mirai botnet is back — now as "Meris" 

Peace, 

An undisclosed (or, even, yet undiscovered by the vendor) 
vulnerability in SOHO Mikrotik routers seems to be exploited by 
someone. 
Approx. 328 thousand devices already joined the botnet, with each 
having unrestricted access to the uplink (up to 1 Gbps). 42,6% of 
exploited devices reside in the U.S. 

https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/ 

I didn't know Mikrotik was so popular in North America! 
Patching all those SOHO WiFi routers must be fun... 

-- 
Töma 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20210909/ec1f70b8/attachment.html>