Why Edge Routers Become a Standing Botnet Risk

Every few months a critical vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. lands in a class of hardware that sits at the edge of networks: home and small-business routers, wireless gateways, VPN concentrators. The September 2026 MikroTik RouterOS flaws, an unauthenticated SSH takeover chain exploited in the wild before the advisory was public, fit a pattern that predates them by a decade. Edge routers become botnetBotnet🛡️A network of internet-connected devices compromised and controlled by an operator, used for denial-of-service attacks, proxying malicious traffic, credential stuffing or spam. Edge routers are prized botnet hosts because they are numerous, always on, directly reachable and rarely inspected by their owners. feedstock, again and again, and the reasons are structural rather than accidental. This article is about that structural problem, why the installed base of internet-facing routers is a standing risk regardless of any single CVE, and how to plan for it rather than react to each incident.

Why routers are the perfect botnet host

Consider what a botnet operator wants: a device that is numerous, always on, decently powerful, directly reachable from the internet, and rarely inspected by its owner. An edge routerRouter🌐A device that directs data packets between your local network and the internet. is all of those things at once. There are millions of them from any given vendor. They run continuously by definition. Modern models have real CPUs and gigabit interfaces. They hold a public IP addressIP Address🔐A unique numerical identifier assigned to every device connected to the internet., which is the entire point of the device. And almost nobody logs into their router between the day it is installed and the day it dies.

Servers get patched because someone is responsible for them. Laptops get patched because they nag the user and phone home to a management console. Routers get patched when a technician happens to remember, which for a large fraction of the installed base is never. That gap between a fix being available and a fix being applied is where botnets live.

The history is not subtle

MikroTik hardware specifically has been conscripted repeatedly. VPNFilter infected home and small-office routers, MikroTik among them, at a scale that drew an FBI takedown. The Mēris botnet, built substantially from compromised MikroTik devices, drove some of the largest denial-of-service attacks on record. Trickbot operators used hacked MikroTik routers as proxy infrastructure to hide command-and-control traffic. In each case the devices were not exotic targets; they were ordinary routers whose owners never noticed they had joined a botnet, because a router that is forwarding your packets and also someone else's malware looks, from the couch, exactly like a router that is working fine.

An unauthenticated pre-authentication chain like MikroTrick is precisely the raw material these campaigns are built from. It requires no credentials, no user interaction, and no social engineeringSocial Engineering🛡️The psychological manipulation of people into performing actions or divulging confidential information, exploiting human trust rather than technical vulnerabilities., only a reachable port. The mechanics of how such a bypass works are covered in our explainer on how SSH servers get tricked into skipping authentication; the strategic point is that a single such bug against a population this large produces compromised devices faster than the ecosystem can clean them.

The patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program. gap is worse than for servers

Three properties make edge-router patching harder than server patching, and any plan has to account for all three.

• **You do not control most of the fleet.** A wireless internet provider owns the router at each subscriber's home. An enterprise owns branch-office gear it never physically visits. The devices you most need to patch are often the ones you can least easily reach.
• **The disclosure window favors the attacker.** MikroTik shipped fixes on 3 September 2026 with almost no detail, then the flaws were reverse-engineered from the patched binaries within a day and exploited before the formal advisory on 5 September. Silent patches do not buy silence; they buy attackers a head start on defenders who did not know to hurry.
• **Cleanup is not a reinstall.** An attacker who has created accounts, scheduled tasks and tunnels is not evicted by a firmwareFirmware🏠Permanent software programmed into a device's hardware that controls its basic functions. update. Recovering a compromised router means treating it as fully owned, wiping it, and rebuilding from a trusted configuration, the same rigor our post-compromise checklist for self-hosted services applies to any breached asset.

Planning for the long tail

You cannot make edge routers patch themselves, but you can shrink both the exposure and the blast radius with decisions made before the next advisory.

Start with an inventory that actually exists. You cannot patch or isolate what you have not written down, so maintain a live list of every internet-facing device, its model, its firmware version and its management exposure. Make "management planeManagement Plane🌐The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise. reachable from the internet" a tracked, exception-only state; the concrete settings for one vendor are in our guide on how to lock down MikroTik RouterOS management access, and the principle generalizes to every router brand you run.

Set patch SLAs by exposure, not by convenience. A router with SSH open to the world and a router with management bound to a VPN are not the same risk and should not share a deadline. Segment management onto its own network so that a compromised edge deviceEdge Device🌐A network appliance that sits on the boundary between the internet and an internal network, such as a VPN gateway, firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules., or secure-access appliance. Edge devices are internet-facing, hold credentials, and broker connections inward, which makes them high-value and frequently repeated targets for zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. exploitation. cannot immediately pivot into everything behind it. Monitor for the signatures of conscription, unexpected administrative accounts, outbound connections to unfamiliar domains, scheduler entries you did not create, because a botnet's whole business model depends on you not looking.

Finally, plan for the devices you will lose. Some fraction of any large router fleet will be compromised and never cleaned, and a resilient design assumes that rather than hoping otherwise. The pattern of repeat zero-days in remote-access appliances that we have tracked across recent VPN advisories is the same pattern here: the specific CVE changes, the structural exposure does not. Build for the standing risk, and each new MikroTik-shaped headline becomes a maintenance task instead of an emergency.