[paulnpace]

Dumb guy question:

Did they search for MikroTik because it is easy to search for and has some history of vulnerabilities?

[marcus0x62]

They did a Shodan-style search on the IPs they believed were involved in the attack and determined they were Mikrotik routers.