MikroTik botnet uses misconfigured SPF DNS records to spread malware

Infoblox discovered an active malspam campaign that leverages misconfigured SPF records (+all) across ~20,000 domains to spoof senders and deliver malicious ZIP attachments; ~13,000 compromised MikroTik routers were configured as SOCKS4 proxies to relay phishing emails, enable large-scale DDoS, and hide attacker infrastructure, with payloads executing PowerShell connecting to a C2 domain linked to Russian hackers.