# forensics

Published articles for forensics.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms

DevFeed: [Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms](<https://devfeed.tech/articles/a-first-hand-forensic-walkthrough-of-a-real-router-compromise-40164.md>)

Original publisher: [Read original article](<https://blog.j2sw.com/netops/mikrotik-router-compromise-forensic-walkthrough/>)

Author: j2sw

Published: 2026-09-16T13:32:46Z

Content type: article

Language: en

Sources: [Justin Wilson (j2sw)](<https://devfeed.tech/sources/justin-wilson-j2sw.md>)

Topics: [MikroTik](<https://devfeed.tech/topics/mikrotik.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>), [remote access](<https://devfeed.tech/topics/remote-access.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [ssh](<https://devfeed.tech/topics/ssh.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [forensics](<https://devfeed.tech/tags/forensics.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [mikortrick](<https://devfeed.tech/tags/mikortrick.md>), [mikrotik](<https://devfeed.tech/tags/mikrotik.md>), [network-operations](<https://devfeed.tech/tags/network-operations.md>), [network-security](<https://devfeed.tech/tags/network-security.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>), [security](<https://devfeed.tech/tags/security.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

A forensic walkthrough examines a compromised MikroTik router in a honeypot. The intruders established persistence and remote access through scheduled tasks, scripts, new users, and tunnels. The author suspects, but cannot prove, that the compromise involved the MikroTrick RouterOS vulnerability chain.

### Source excerpt

What it looks like when an intruder tries to make your own router work against you. A note before we start: Anything in this post that could identify my network, my organization, or my router's real hostname and IP address has been redacted or made generic. The attacker's own infrastructure, such as IP addresses, ports, ... Read more The post A first-hand forensic walkthrough of a real router compromise appeared first on Justin Wilson (j2sw).