Недавно пришло письмо от саппорта микротика
Hello,
It has come to our attention that a rogue botnet is currently scanning random public IP addresses to find open Winbox (8291) and WWW (80) ports, to exploit a vulnerability in the RouterOS www server that was patched more than a year ago (in RouterOS v6.38.5, march 2017).
Since all RouterOS devices offer free upgrades with just two clicks, we urge you to upgrade your devices with the "Check for updates" button, if you haven't done so within the last year.
More information can be found here: https://forum.mikrotik.com/viewtopic.php?f=21&t=132499
Best regards,
MikroTik
В общем, везде тушим Webfig и проверяем прошивки
(недавно такую новость видел, но поиском не нашел, сорри если дубль)