SOCKS proxy enabled on a MikroTik: the classic sign of a hacked router

What the audit found

The SOCKS proxy (IP → SOCKS) is enabled on your router. RouterOS ships with it disabled, and there are very few legitimate reasons to turn it on.

The audit reports this as critical regardless of firewall settings, because the setting itself is the concern: an enabled SOCKS proxy is one of the most reliable indicators that somebody other than you has been changing the configuration. If you enabled it deliberately and know why, you can treat the finding as a reminder; if you did not, read on carefully.

Why it matters

A SOCKS proxy turns the router into a relay. Whoever can connect to it can send traffic through your router, using your public IP address as the source. That is exactly what botnet operators want.

The sequence is well documented. After the 2018 Winbox vulnerability (CVE-2018-14847) exposed hundreds of thousands of MikroTik devices, the malware that took them over followed a routine: create a scheduler entry that fetches a script, add a hidden user, and enable the SOCKS proxy. The Mēris botnet of 2021 used the same routers to launch some of the largest DDoS attacks ever recorded; Glupteba and TrickBot used compromised MikroTik proxies to hide their command-and-control traffic. Your router does the work, and your address ends up on blocklists or in an abuse report from your ISP.

The proxy is a symptom, not the disease. If an attacker enabled it, they had full access to the router: they may have changed passwords, added users, planted scripts that re-enable the proxy after you turn it off, or altered DNS to redirect your users. Disabling the proxy alone undoes none of that.

What it looks like in Winbox

Open IP → SOCKS. If the Enabled box is ticked and you do not remember ticking it, this is the finding. The Access tab lists who is allowed to use the proxy; entries you did not create are another sign of tampering.

While you are there, look at System → Scheduler, System → Scripts, System → Users and Files for anything you do not recognise.

How to fix it

If you enabled the proxy yourself and no longer need it, the fix is simply to untick Enabled under IP → SOCKS. Doing so does not affect your own management session, so Safe Mode is not needed for that single change.

If you did not enable it, do not stop there. Assume the router is compromised and go through the usual hiding places: the SOCKS access list, System → Scheduler, System → Scripts, System → Users and Files. Look for scheduler entries that fetch a URL, scripts you did not write, users you did not create (attackers pick names that look like system accounts) and unfamiliar files; also check IP → DNS for changed servers and IP → Firewall → NAT for redirect rules.

The only clean fix for a compromised router is to rebuild it: keep only an export you have reviewed line by line, reinstall RouterOS with Netinstall, upgrade to a current version, restore the configuration by hand, and change every password — router users, PPP secrets, WiFi keys and anything reused elsewhere. Then make sure management services are not reachable from the internet, or the same thing will happen again.

Afterwards, confirm under IP → SOCKS that the proxy is disabled, check that the scheduler, script and user lists contain only entries you created, and watch the Log for a few days for unexpected logins or scheduler activity. Then re-run the audit: the finding disappears, and any related findings (suspicious scripts, unknown users) should be gone as well.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I use the SOCKS proxy on purpose. Is that a problem?

Not by itself, but restrict it. Set an access list under IP → SOCKS → Access that allows only your internal addresses, make sure the firewall drops the proxy port from the WAN side, and use authentication. The audit will still flag the setting, because it cannot tell an intentional proxy from a planted one; treat the report as a reminder to check that the restrictions are still in place.

Can I just disable it and change the admin password?

You can, but you will not know what else was changed. Malware on MikroTik routers routinely adds a scheduler entry that re-downloads itself and re-enables the proxy, so the setting comes back within hours. Reinstalling with Netinstall is the only way to be certain the device is clean.

How did they get in?

Most often through a management service (Winbox, www, API) reachable from the internet on an outdated RouterOS version, or through a weak password. The rest of your audit report will usually point at the door that was left open.