A botnet called Doorway left 41 GB of its own files exposed, and routers with default passwords are its favourite way in

Criminal infrastructure gets left open more often than you'd think, and when it does the paperwork is revealing. Researchers at CloudSEK found two attacker workspaces exposed in October and pulled about 41 GB of operational data out of them, belonging to a botnet they've named Doorway. Their report, published on 28 October, reads like a courier company's logistics dashboard, except the parcels are routers and cameras.

The main way in is MikroTik RouterOS, through CVE-2023-30799, a flaw that has had a fix for three years, and through the oldest trick going: default admin logins, including an empty password. The records show 7,369 successful MikroTik logins across 4,923 devices. The operators' own ledger claims 11,363 device joins and 58,920 payload downloads in a single hour, although that figure isn't independently verified and CloudSEK treats its numbers as minimum counts. Once inside, Doorway sets up SOCKS proxies, quietly turning someone's internet connection into a relay for other people's traffic. One ISP alone had 1,060 subscriber records in the haul.

MikroTik isn't the brand most households would recognise, but internet providers hand out plenty of it, and the 59 exploit modules also cover cameras, fibre boxes and other ISP-supplied kit. The defences are dull and effective. Change the router's admin password if it's still the default, or worse, blank. Turn off remote management from the internet, switch off Telnet and UPnP if the settings allow it, and install firmware updates. A router doing proxy work for strangers rarely shows any symptom beyond a slower connection, so if your provider gave you the box, ask them whether its firmware is current.

Tendvane's Network scan lists every device on your home network, a quick way to spot the old camera or forgotten box that nobody has updated since it was plugged in.