A patched router can still belong to the attacker.
Our latest RouterOS research reproduces the MikroTrick takeover chain and examines persistence found on real devices including privileged accounts, scripts, and scheduled tasks that can survive after logs are gone.
Patch. Then investigate.