Proxyjacking campaign hijacks D-Link, Ubiquiti devices
A proxyjacking operation is quietly turning compromised edge devices into paid exit nodes for a commercial residential proxy network. Threat intelligence company GreyNoise has linked the campaign to at least 143 hijacked devices in 34 countries.
The attacker does not use custom malware to make money from the victims. Instead, they install Pawns.app, a legitimate bandwidth-sharing application, on systems they have broken into. The owners never agree to this.
How the scheme pays out
Pawns.app is built for people who want to earn a little money from their spare internet capacity. Account holders are paid for letting other users' traffic pass through their connection. The service only rewards this when the traffic runs over trusted IP addresses that are not blocked.
Residential and business connections on real devices fit that requirement. Every extra machine running the app under the attacker's account adds bandwidth to sell, so spreading the software across many systems probably meant bigger payouts for the operator.
GreyNoise found the campaign while it was looking into suspicious activity at an organization it did not name. Following the trail led researchers to compromised devices around the world.
The vulnerabilities behind the break-ins
According to GreyNoise, the attacker exploited several known flaws to get onto edge devices and install the Pawns.app software:
- CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices
- CVE-2021-44228 in Ubiquiti UniFi Video NVR
- CVE-2025-31324 in SAP NetWeaver Visual Composer
The researchers also saw the attacker going after Hikvision and Dahua DVR and NVR devices. They did not say which vulnerabilities were used against those systems.
In some cases, the attacker set up SSH key authentication as a second way back into the device. This means a compromised system can stay reachable even after the original entry point is closed.
Why the victims should care
Losing some bandwidth is not the only cost. Even legitimate proxy networks can end up routing suspicious traffic through the nodes that volunteers run, because oversight of that traffic is often weak. Users whose connections take part can have their IP addresses blocked. They can also be accused of involvement in illegal activity that someone else carried out over their line.
The FBI has warned before that networks of this kind have been used for large-scale credential stuffing attacks against online platforms.
What users can do
GreyNoise offers a free service for checking whether an IP address belongs to a known legitimate or "gray" proxying service. It requires an account.
Standard advice also applies here. Software from untrusted sources should be avoided, as some supposedly free tools carry malware that signs devices up to residential proxy networks. Because attackers routinely go after known flaws in internet-connected hardware, keeping NAS devices, video recorders and other exposed systems updated cuts the risk of compromise considerably.
Patching alone is not enough, though. Strong credentials, a secure configuration and limits on network access all help close the gaps that campaigns like this one depend on.
Our Take
The campaign is a reminder that old bugs on forgotten hardware still pay. The list of exploited flaws includes Log4Shell from 2021 and two D-Link NAS issues from 2024, alongside a SAP NetWeaver bug. This suggests the operator went for whatever exposed systems were easiest to reach, not for specific targets.
It also fits a wider pattern of compromised edge devices being put to work for someone else's profit or operations. Using a legitimate app makes the abuse harder to spot, since security tools may not flag it as malicious.
It is worth watching whether bandwidth-sharing services tighten account checks in response. Organizations should also check whether their own IP ranges appear in proxy networks they never joined.