Researchers: 415K+ routers worldwide, majority of them from MikroTik, have been infected with cryptomining malware CoinHive, Omine, and CoinImp
Researchers have discovered over 415,000 routers across the globe have been infected with malware designed to steal their computing power and secretly mine cryptocurrency.
Context & Ripple Effects
Router botnets are a recurring story: researchers flagged self-sustaining botnets of poorly secured routers in 2015, then a stealthy Cisco router backdoor that same year, and by May 2018 Cisco's Talos counted 500K+ routers infected by Russia-linked malware across dozens of countries. What's new here is the payload — instead of espionage or attack staging, the malware steals compute cycles to mine cryptocurrency.
The victim profile also sharpens an existing pattern: Securelist's September survey of IoT attack vectors already had MikroTik devices topping the list of most-compromised devices, ahead of TP-Link, so this infection wave concentrates on the vendor the data had already flagged.
First-order effects
- Owners of hundreds of thousands of mostly MikroTik routers lose bandwidth and device performance to hidden mining, while paying for electricity consumed by someone else's CoinHive, Omine, or CoinImp rigs.
Second-order effects
- MikroTik faces pressure to force firmware updates and lock down default configurations, since its install base is now demonstrably the preferred target; TP-Link and other vendors on the same top-compromised list must show they aren't next.
Third-order effects
- If mining malware keeps converting consumer infrastructure into revenue, ISPs and regulators face pressure to treat unpatched home routers as a systemic risk rather than a user problem — extending the arc from the 2015 botnet findings to today's monetized infections.
The trend: Compromised routers are shifting from espionage and attack-staging botnets toward direct monetization through cryptomining, with weakly secured vendors like MikroTik as the recurring entry point.