When Simple DNS Mistakes Lead to Big Attacks: Lessons from the MikroTik Botnet

When Simple DNS Mistakes Lead to Big Attacks: Lessons from the MikroTik Botnet

Cybersecurity is often seen as a battle against highly complex exploits. Yet, some of the most impactful attacks begin with the smallest mistakes. A recent discovery of a large-scale botnet highlights just how dangerous small DNS misconfigurations can be. 

The Attack: hijacked routers and weak SPF records 

Researchers uncovered a global botnet built on more than 13,000 compromised MikroTik routers. Attackers turned these devices into relays, hiding their tracks and sending spam and malware around the world. 

The real enabler, however, was DNS. Thousands of legitimate domains were found with misconfigured SPF records. Many used the permissive +all setting, which effectively tells mail servers to trust anyone. This oversight allowed attackers to spoof about 20,000 domains, making their phishing emails look authentic and bypassing standard security checks. 

The campaign began with malspam disguised as DHL Express invoices. Victims received ZIP files containing obfuscated JavaScript, which executed PowerShell scripts connecting back to a command-and-control server linked to Russian threat actors. With scale, stealth, and spoofed trust on their side, the attackers were able to distribute malware widely and convincingly. 

Why This Matters 

This incident is a clear reminder that security gaps don’t always stem from sophisticated zero-days. Sometimes, it’s the overlooked basics — like a misconfigured SPF record — that open the door to global campaigns. The scale of this botnet and its ability to bypass established protections underlines the importance of continuous DNS hygiene. 

• Scale: Tens of thousands of domains were spoofed at once, giving attackers global reach. 
• Stealth: Malicious traffic was routed through thousands of legitimate-looking routers, making detection difficult. 
• Impact: Standard email defenses (SPF, DKIM, DMARC) were bypassed due to misconfigurations, allowing malware and phishing messages to slip through. 

How CheckRed DNSPM helps 

At CheckRed, we believe DNS security starts with visibility and proactive management. CheckRed DNS Posture Management (DNSPM) is designed to identify and close the very gaps that powered this attack. 

With DNSPM, organizations can: 

• Detect and correct misconfigured SPF, DKIM, and DMARC records before attackers exploit them. 
• Monitor DNS changes in real time and receive alerts for unauthorized updates. 
• Protect domains at scale with continuous posture checks across all accounts and apps. 
• Visualize DNS threats through detailed dashboards, severity alerts, and guided remediation steps. 

Final thoughts 

This botnet shows how a “small” DNS mistake can escalate into a large-scale security incident. The lesson is simple: securing DNS configurations must be treated as a priority, not an afterthought. 

CheckRed DNSPM ensures that misconfigurations are identified and resolved before attackers can exploit them, protecting organizations, domains, and customers from avoidable threats. 

About the Author

Rajdatta Rokade

QA Automation & Technology Professional at CheckRed

Rajdatta is a multi-disciplinary technology professional with expertise spanning quality engineering, automation, and modern DevOps practices. With a background that bridges product reliability, cloud security, and cross-functional collaboration, he brings a systems-thinking approach to strengthening software delivery. Passionate about innovation and precision, Rajdatta is dedicated to advancing automation practices and ensuring that complex systems remain reliable, efficient, and secure in a rapidly evolving digital landscape.