Threat intel

On October 28, CloudSEK published its analysis of Doorway, a botnet operation that breaks into routers, surveillance cameras, fibre network terminals and enterprise servers. The researchers came across two identical attacker workspaces left in open directories on the internet in October 2026, holding about 41 GB of source code, credentials, logs and malware delivery tooling.

If you run MikroTik routers, IP cameras or an internet-facing Jenkins, Openfire, Apache Tomcat or Apache ActiveMQ server, you are in the target list. Most of its recorded success came from default passwords and flaws patched in 2023, so the fixes are already available.

How the engine works

The core is a Rust program called doorway, about 21,870 lines of the operator's own code, with 59 exploit modules covering cameras, routers, optical network units (the fibre boxes an ISP installs at the customer site) and Java services. It scans internet-facing addresses, compares each response against device fingerprints, and only runs a module when the fingerprint matches. CloudSEK notes that some modules require several banner strings to match, so the engine skips lookalike devices.

Access comes from a vulnerability or a password. Once inside, the engine does not drop a full binary. It runs a small loader that works out the operating system and processor architecture (x86, ARM, MIPS and Windows builds all exist), then fetches the matching payload over HTTP, FTP, TFTP or netcat, with wget and curl as the usual tools. The last step checks that the payload actually ran, rather than counting downloads, and the operator shifts effort to new targets when results drop.

On MikroTik RouterOS, the documented chain logs in to WebFig, the router's web management page, as admin with an empty password, and also tries a devel account with an empty password. CloudSEK says the delivery chain centres on CVE-2023-30799, known as FOISted, a privilege escalation that lets an authenticated admin become super-admin and run code on the underlying system. It needs admin credentials, which is why a blank admin password turns it into a full takeover. NIST scores it 7.2 and VulnCheck 9.1. One script in the workspace also changes the Winbox and web-management ports.

What the logs show

CloudSEK's figures cover a scan run from September 19 to October 19, 2026, and the researchers call them minimum counts:

• 7,369 successful MikroTik RouterOS authentications across 4,923 device identities. The report's own assessment section describes the same number as SOCKS proxy configurations, so treat it as logins that led to proxy setup on many routers, not as a count of fully owned devices.
• 4,671 device recruitment records from 4,217 distinct IP addresses, 1,772 of them geolocated, and 1,060 PPPoE subscriber records tied to a single ISP.
• 20 Jenkins servers with confirmed remote code execution and 16 Openfire plugin uploads on real, non-test targets.
• 18 router compromises through a separate implant branch CloudSEK calls DARKLANTERN, eight of them confirmed by beacon traffic.

The attacker's own ledger claims 11,363 device joins and 58,920 payload fetches in 60 minutes. CloudSEK's report attributes the 11,363 figure both to that hour and to the whole scan run, and news coverage says it was not independently verified, so it is the operator's claim. The RouterOS stage2.so branch is also unproven in the field: the log shows three attempts with no beacon back.

A file called WATCHER-BRIEF.md describes five concurrent agent sessions managing the operation, and CloudSEK ties them to tooling built on a large language model. Which AI tool, who runs Doorway, what the final clients do and how the operation makes money are all still unknown.

What to do

1. Fix credentials first. Set a strong, unique admin password on every MikroTik router and remove or disable any devel account. Do the same on cameras and fibre terminals, including the vendor default accounts that ship with them, and stop reusing one password across a fleet.
2. Take management off the internet. WebFig, Winbox, Telnet, camera web pages and Jenkins should only be reachable over a VPN or a management VLAN. CloudSEK also advises turning off Telnet and UPnP wherever the device does not need them.
3. Patch the 2023 flaws. RouterOS stable 6.49.7 or later fixes CVE-2023-30799 (long-term releases up to 6.48.6 are affected). Openfire needs 4.6.8, 4.7.5 or later for CVE-2023-32315, the admin console path traversal that has been on the CISA Known Exploited Vulnerabilities list since August 24, 2023; the vendor scores it 8.6 and NIST 7.5. CloudSEK's ActiveMQ detection rule is labelled "CVE-2023-46604 style" without naming the CVE as confirmed, so patch ActiveMQ to 5.15.16, 5.16.7, 5.17.6, 5.18.3 or later either way, and keep the OpenWire port, 61616 by default, off the internet.
4. On Jenkins, disable anonymous access to the Script Console, which runs Groovy code on the controller, and require login for everything. CloudSEK also lists Confluence, ManageEngine, Mirth and LiteLLM as services to patch or isolate.
5. If you cannot patch today, add a firewall rule that allows the device's management ports only from your admin network, and change the password, so the login step the RouterOS chain depends on fails.

How to check for compromise

On MikroTik, run /user print and look for accounts you did not create, check /ip socks print for an enabled SOCKS service (CloudSEK says port 1080 or a nonstandard port), and look for a file at /flash/rw/disk/stage2.so with /file print. Note that the Winbox and web ports may have been moved, so compare /ip service print with your baseline.

On servers, review Openfire's plugin list for anything you did not install (the report names a stage-2 plugin, ofvalid.jar), look for unexpected WAR files under Tomcat's webapps folder (the report lists ang23.war and d.jsp), and alert when the ActiveMQ Java process starts a shell. On Linux hosts, check /tmp/a, /tmp/d and /var/tmp/.d.

On the network, alert on outbound connections from routers, cameras and servers to the addresses in CloudSEK's indicator list: 45.90.13.169 (payload server on ports 80, 2121, 69 and 8080), 45.90.13.11, 45.205.1.9 (ICMP beacon and a reverse shell on TCP 4444), 176.98.182.21 and 184.174.96.216. Inbound requests with the User-Agent Hello World are the scanner. These indicators come from CloudSEK's report alone and no other source has reproduced them yet, so treat a hit as a lead to investigate. A camera or router should rarely open outbound connections at all. Block egress from those device subnets except to the update and time servers they need, and alert on any new destination, which also catches the next infrastructure change.

If you find signs of compromise, reset the device to factory settings and reinstall current firmware rather than cleaning it in place, then set new credentials before reconnecting it. For a Jenkins or Openfire server, rotate every secret the service could read.

Where this leaves edge devices

Most of what Doorway logged came from 2023 flaws and blank or default passwords on management pages that faced the internet. Our network penetration testing checks exactly those management interfaces and default accounts, and attack surface management keeps watch for new ones appearing on your address ranges. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: CloudSEK, The IT Nerd, Cybersecurity Asia, Vosveteit, NVD CVE-2023-30799, GitHub advisory for CVE-2023-32315, OSV CVE-2023-46604.