Since the code for the CVE-2018-14847 was published, many "bad guys" have been using it to repeat their own version of the original attack. Thousands of unpatched MikroTik devices are currently mining.
Router makers have released the necessary update since April, but few users have installed it, leaving their devices exposed to the vulnerability and allowing cybercriminals to compromise their devices.
Security researcher Troy Mursch, an expert in detecting botnets and cryptojacking campaigns, discovered that the same infected MikroTik routers that were infected by the last campaign are now running a mining script.
According to Troy, the malware uses 80% of the processor of each MikroTik router, leaving room for other processes to run in parallel. This way, the device does not "freeze" and the user may be slow to realize that something is wrong.
The number of victims is difficult to estimate as these devices are infected with different malware every minute. The vulnerability has been public for months, which has given hackers plenty of time to create their own automated tools.
A Shodan search showed 3,734 routers infected with the mining tool, a number that quickly rose to 3,805. Brazil has the most cases with 2,612, followed by Argentina with 480. There are many countries with affected devices, but the numbers are much smaller.
In early August, a large cryptojacking campaign was uncovered, affecting more than 170,000 MiktoTik routers, again with the highest number of cases in Brazil. Qihoo 360 Netlab also conducted another investigation, revealing eavesdropping capabilities of the victims.
