Proxyjacking Campaign Hijacks D-Link, Ubiquiti Devices to Resell Bandwidth

Proxyjacking Campaign Discovered

A proxyjacking campaign has been identified that hijacks internet-connected devices in 34 countries. The attackers install Pawns.app, a legitimate bandwidth-sharing application, on devices without the owners' knowledge or consent. This allows the attackers to monetize the victims' internet connections by reselling their bandwidth through a commercial residential proxy network.

Exploited Vulnerabilities

Threat intelligence company GreyNoise discovered the campaign and identified at least 143 compromised devices globally. The attackers leveraged several vulnerabilities to breach edge devices, including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, and CVE-2021-44228 in Ubiquiti UniFi Video NVRs. SAP NetWeaver Visual Composer (CVE-2025-31324) was also targeted, and Hikvision and Dahua DVR/NVR devices were observed as targets, though specific vulnerabilities for these were not detailed.

Impact on Victims

Victims of this campaign may experience their IP addresses being used for suspicious traffic, potentially leading to IP blocks or allegations of involvement in illegal activities. The FBI has previously warned that such proxy networks are used for large-scale credential stuffing attacks. In some cases, attackers configured SSH key authentication for backup access to compromised devices.

Mitigation and Prevention

Users are advised to avoid downloading software from untrusted sources, as free software can contain malware that enrolls devices in residential proxy networks. Keeping internet-connected devices like NAS systems and video recorders updated is crucial to reduce compromise risk. Additionally, using strong credentials, secure configurations, and restricting network access are recommended security practices.