Mēris botnet
MikroTik-router botnet behind record 2021 denial-of-service attacks on Yandex.
MikroTik drew three CISA exploited-flaw listings in September 2026, its first since 2022, and Mēris is the precedent: a botnet of MikroTik routers that flooded Yandex with 21.8m requests per second on 5 September 2021.
Last refreshed: 12 October 2026
How did old stolen passwords build a record botnet from MikroTik routers?
Timeline for Mēris botnet
Named as Mēris botnet
Cybersecurity: Threats and Defences: Mentioned in: CISA set three-day deadlines on 34 flawsBackground
Mēris was a botnet assembled from MikroTik routers. In 2021 it launched what were then record request floods against Yandex, and it stands as the reference case for the RouterOS flaws CISA listed as exploited in September 2026.
Yandex and Qrator Labs tracked the attacks as they grew, from 5.2m requests per second on 7 August 2021 to 21.8m on 5 September. Yandex put the number of infected devices at about 250,000. MikroTik said the routers had been taken over in 2018 through a RouterOS flaw that it had since patched, and that upgrading firmware did not HELP owners whose passwords had already been stolen.
MikroTik's advice to owners was to change passwords and delete any scripts they did not recognise.