MikroTik RouterOS 'ops' admin account created after '-2' login anomaly

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•7

Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.