router news
5 stories
MikroTik Routers Compromised Via Unauthenticated SSH Access
Reports indicate that MikroTik routers are currently being compromised through their internet-exposed SSH services. The attacks leverage an unauthenticated access vector, allowing threat actors to bypass typical security measures and gain full administrative control over affected devices. This exploitation has reportedly been active since at least September 2.
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors
Cybersecurity researchers have identified an expansion in the arsenal of a China-linked advanced persistent threat (APT) group, known for its operations under the name LapDogs. This threat actor has reportedly introduced new malware components, specifically focusing on compromising small office/home office (SOHO) routers. The newly identified backdoors have been named LongLeash, DogLeash, and…
Chinese hackers develop LONGLEASH malware to expand ORB network
Chinese threat actors, identified as UAT-7810, are actively developing and deploying new malware to enhance their Operational Relay Box (ORB) network. This network, previously documented as a secure relay infrastructure for other China-aligned advanced persistent threat groups, is being expanded by compromising internet-facing networking devices, with a particular focus on unpatched Ruckus…
Hidden backdoor in Tenda router firmware grants admin access
A security vulnerability has been discovered in the firmware of several Tenda router models, creating a hidden backdoor that could allow unauthorized administrative access. The issue, tracked as CVE-2026-11405, stems from an undocumented authentication mechanism within the device's web server.
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
A significant security vulnerability has been discovered in the firmware of several Tenda router models, potentially exposing users to unauthorized administrative access. The CERT Coordination Center (CERT/CC) has issued a warning about this hidden backdoor, which allows attackers to bypass normal authentication procedures and gain control over the router's web interface.