Friday 16 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Proxyjacking campaign hijacks D-Link and Ubiquiti devices to sell stolen bandwidth in 34 countries

GreyNoise finds at least 143 compromised edge devices running a legitimate bandwidth-sharing app without owners' consent

By LineZotpaper
Published
Read Time2 min
A proxyjacking campaign has compromised internet-connected devices in 34 countries, installing a legitimate bandwidth-sharing application on victims' hardware to monetise their connections without consent, according to threat intelligence firm GreyNoise.

Threat intelligence firm GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organisation, and identified at least 143 compromised devices worldwide.

According to the researchers, the attacker installed Pawns.app, a legitimate bandwidth-sharing application that pays users for allowing traffic from other customers to flow through their network, on devices without the owners' consent. By enrolling multiple systems, the operator likely accumulated larger payouts.

GreyNoise linked the intrusions to known vulnerabilities, including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer. The researchers also observed targeting of Hikvision and Dahua DVR/NVR devices, but did not specify the vulnerabilities exploited in those systems. In some cases, the attackers configured SSH key authentication as a backup access method.

The researchers cautioned that even legitimate proxy networks can route suspicious traffic through volunteer-operated nodes due to insufficient oversight, potentially resulting in IP address blocks for participating users or exposing them to allegations of involvement in illegal activity. The FBI has previously warned that such networks have been used in large-scale credential stuffing attacks against online platforms.

GreyNoise advises keeping NAS devices, video recorders and other internet-facing systems updated, using strong credentials, and restricting network access. The company also offers a free service for users to check whether their IP address is part of a known proxy service.

§

Analysis

Why This Matters

  • The campaign shows ordinary edge devices, such as network-attached storage and video recorders, can be silently converted into paid bandwidth proxies, allowing attackers to profit from victims' internet connections.
  • Hijacked connections can be used for credential stuffing and other abusive traffic, leaving victims exposed to IP blocks or allegations of involvement in illegal activity.
  • The breaches relied on known, publicly documented vulnerabilities, a reminder that unpatched internet-facing hardware remains a soft target.

Background

Proxyjacking is a form of cybercrime in which attackers compromise computing devices and quietly enrol them in residential proxy networks. Residential proxies are valuable because traffic appears to come from ordinary home and business connections rather than data centres, which many online platforms treat as more trustworthy. That makes them useful for credential stuffing, ad fraud and other automated abuse. The attack follows a familiar pattern in which attackers scan the internet for devices running outdated software and exploit known flaws before operators have a chance to patch.

Key Perspectives

GreyNoise (researchers): Documented at least 143 compromised devices across 34 countries and traced the intrusions to specific vulnerabilities in D-Link, Ubiquiti and SAP products, with SSH keys added for persistent access. Pawns.app and similar bandwidth-sharing services: Market themselves as legitimate ways for users to earn from spare bandwidth, but GreyNoise notes oversight can be insufficient, allowing abusive traffic to flow through volunteer nodes. Device owners and security teams: Face both direct compromise and downstream consequences such as blocked IP addresses or suspicion of criminal activity; researchers urge patching, strong credentials and restricted network access. Skeptics: May ask whether residential proxy platforms do enough to vet their users, since the same monetisation model that rewards bandwidth sharing can be exploited by attackers.

What to Watch

  • Whether Pawns.app or similar platforms tighten user verification and traffic vetting in response to the findings.
  • Whether researchers identify the operator behind the campaign or link it to a known group.
  • Whether further enterprises report infections, since the campaign was discovered while investigating one organisation's suspicious activity.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe