A hacked router, a surveillance camera or a company server can be used as a relay by strangers: that is the principle behind Doorway, a cyberattack campaign uncovered in October 2026 by researchers at the cybersecurity company CloudSEK. According to the Swiss IT magazine ICTjournal, which reported on it on 29 October 2026, the operation aims to build a proxy network. An internal register kept by the attackers lists 11,363 compromised devices, and the campaign was still active during the investigation.
How does the Doorway campaign work?
It all started with a mistake by the attackers. In October 2026, the CloudSEK team found two publicly accessible directories, totalling 41 GB of exposed data. They contained the operation's source code, login credentials, activity logs and malware deployment tools.
The contents of the two directories were identical. According to CloudSEK's analysis, they therefore belonged to a single operation with a redundant infrastructure.
The attack engine is written in Rust, a programming language. It has 59 exploitation modules, each targeting a category of equipment or service. Among other things, it combines three methods:
- trying default or previously exposed credentials;
- exploiting vulnerabilities;
- command injection.
Once access is gained, several mechanisms download and then execute a malicious payload adapted to the architecture of the targeted system.
The campaign is also supervised by software agents. Among the exposed data, one document describes five agent sessions tasked with supervising different aspects of the operation. This system tracks the results of scans and exploitation attempts. It redirects efforts towards other categories of targets when their effectiveness declines. According to CloudSEK, these sessions are linked to tools based on large language models (LLMs), although the researchers were unable to identify the artificial intelligence system used.
Hacked router, camera, server: which equipment is targeted?
Doorway targets routers, surveillance cameras, telecom network equipment and company servers. The recovered logs mainly detail network equipment from the MikroTik brand. The table brings together the figures published by CloudSEK and reported by ICTjournal.
| Figure | What it measures |
|---|---|
| 4,217 | Distinct IP addresses in the logs linked to MikroTik equipment |
| 7,369 | Successful authentications on MikroTik equipment |
| 4,923 | Device identities corresponding to these authentications |
| 11,363 | Compromised devices, according to an internal register |
| 58,920 | Malicious payload downloads over a period of 60 minutes, according to the same register |
| 20 | Jenkins servers on which remote code execution is confirmed |
| 16 | Plugin downloads identified on Openfire servers |
These data come in particular from a scanning engine tasked with spotting new victims. It ran from 19 September to 19 October 2026.
Servers are not spared. Besides Jenkins, the researchers cite Openfire, an instant messaging software. The operation therefore goes beyond connected devices alone and affects tools installed within companies.
Why can a Swiss SME end up as a relay?
The purpose of the infrastructure is to build a proxy network, according to CloudSEK. Our analysis: a proxy is an intermediary through which a third party's traffic passes. A compromised router or camera can thus route connections that would appear to come from the company's network, without its owner noticing.
An SME does not need to be singled out to be hit. Many attacks are automated: they sweep the Internet in search of vulnerable equipment, whoever owns it, as our page on IT security for SMEs points out. Doorway illustrates how this works: a scanning engine, modules for each type of device and automated tracking of results.
Many Swiss devices still need fixing after an alert. A dated example, unrelated to Doorway: on 22 October 2026, more than 23,000 servers linked to Switzerland were still vulnerable to the PHP2Shell flaw, according to a survey by the company Risikomonitor, which we covered in detail in our piece on servers exposed to the PHP flaw.
Swiss SMEs are already familiar with this type of attack. According to the SME Cybersecurity 2026 study, published on 22 October 2026, 6% of them suffered a serious cyberattack within three years. Attacks on networks and servers play a role in around a third of incidents.
The weak point lies in the inventory. More than 80% of SMEs install updates, but only around a third keep an inventory of their IT systems, according to the same study. Our analysis: a router, a camera or an old test server easily drops off this list, and therefore out of the updates.
What checks should be carried out on routers and cameras?
No alert from the Federal Office for Cyber Security (NCSC) specific to Doorway appears in our sources. The office's basic measures nevertheless address the methods described by CloudSEK. The table sets them side by side; this comparison is our own analysis.
| Method identified in Doorway | NCSC basic measure |
|---|---|
| Default or previously exposed credentials | Secure passwords and multi-factor authentication |
| Exploitation of vulnerabilities | Install security updates |
| Access to devices from the Internet | Secure remote access |
| Forgotten equipment | Take stock of the company's IT environment |
| Spread after an intrusion | Segment networks |
In practical terms, an SME can start with a few checks:
- draw up a list of its routers, cameras, network equipment and servers, including those installed by a service provider;
- replace factory credentials everywhere with secure passwords;
- install the security updates for each device;
- check which administration interfaces are accessible from the Internet, a point the NCSC stressed during the PHP2Shell alert;
- separate cameras and connected devices from the network holding the company's data.
Securing remote access and segmentation are also among the rules for IT security when working from home. To gauge your level, the SME cybersecurity test, the Cybersecurity-Check, is free and takes a few minutes. The ICT minimum standard serves as a more comprehensive checklist.
If in doubt about a device, the NCSC published on 6 October 2026 the steps to take when a malware infection is suspected. The office receives voluntary reports and runs a 24h/24 on-call line. A cyberattack response plan sets out in advance whom to call.
What we don't know yet
- It is not known whether devices located in Switzerland are among the victims: the ICTjournal article gives no breakdown by country.
- The exact equipment models and the vulnerabilities exploited are not detailed, apart from MikroTik, Jenkins and Openfire.
- The use made of the proxy network and the identity of the operators are not specified.
- The artificial intelligence system used to supervise the campaign has not been identified by CloudSEK.
Sources
- ICTjournal: "A large-scale cyberattack campaign targets routers and servers", 29 October 2026
- 2clics.com: "IT security for SMEs: the basic measures in Switzerland", 22 October 2026
- 2clics.com: "SME cybersecurity: 6% of Swiss companies hit in three years", 23 October 2026
- 2clics.com: "SME cybersecurity: the PHP flaw still exposes 23,000 servers", 26 October 2026
- 2clics.com: "Working from home and IT security: the rules for an SME", 28 October 2026
