Proxyjacking Campaign Compromises D-Link, Ubiquiti and Other Devices in 34 Countries

A proxyjacking campaign compromised at least 143 devices in 34 countries and monetized victims’ internet connections through commercial residential proxy networks, according to threat intelligence company GreyNoise.

Proxyjacking involves secretly using a victim’s internet connection to route traffic for other users. In this campaign, the attackers installed Pawns.app, a legitimate bandwidth-sharing application, on compromised devices without the owners’ consent.

Attackers installed bandwidth-sharing software

Pawns.app allows users to share their internet connection and earn money. Account holders are rewarded when traffic from other users flows through their network, provided the application is running on a trusted, non-blocking IP address.

By installing the application on multiple systems, the attackers may have generated additional payments from the stolen bandwidth.

GreyNoise discovered the campaign while investigating suspicious activity at an anonymous organization. Researchers identified at least 143 compromised devices worldwide.

Known vulnerabilities used to compromise edge devices

Researchers said the attackers exploited multiple vulnerabilities to compromise edge devices and install the Pawns.app software, including:

• CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices
• CVE-2021-44228 in Ubiquiti UniFi Video NVR devices
• CVE-2025-31324 in SAP NetWeaver Visual Composer

Researchers also observed attacks targeting Hikvision and Dahua DVR/NVR devices, but did not specify which vulnerabilities were exploited on those systems.

In some cases, the attackers configured SSH key authentication as a backup access method, according to GreyNoise.

Proxyjacking can expose users to suspicious activity

Even legitimate proxy networks may have insufficient monitoring to prevent suspicious traffic from being routed through volunteer-run nodes. As a result, participating users’ IP addresses could be blocked or associated with suspected illegal activity.

The FBI has previously warned that residential proxy networks are being used to conduct large-scale credential-stuffing attacks against online platforms.

GreyNoise offers a free service, with an account required, that allows users to check whether their IP address is part of a known legitimate or “grey” proxy service.

How to protect NAS, NVR and other internet-connected devices

Avoid downloading software from untrusted sources. Purported free software may contain malware that secretly registers a device with a residential proxy network.

Threat actors also frequently exploit known vulnerabilities in internet-connected devices. Keeping NAS devices, video recorders and other connected systems up to date can significantly reduce the risk of compromise.

Users should also use strong credentials, secure device configurations and restrict network access wherever possible.

Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, correct and revalidate at machine speed.

Please reserve your seat