Attack on the router?

RouterOS General
1

Hi,

We had today some strange behaviour on our router.
The Router is RB1100AH with version 6.42.x
As you can see on the screenshot we got a TCP connection from 60.191.52.254
He locked one of the server with a crypto locker.
Is this a bug in the routeros? Has he hacket the pptp connections?

Thanks Chris

2

Have you ever opened for administration (using Winbox) from the internet?
If so it may be that you have been hacked.
Do a net install with latest fixed ros, and do a search for how to secure remote admin.
Example, use VPN etc.