Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

By Bill Toulas

• October 15, 2026
• 02:20 PM
• 0

A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network.

The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners’ consent.

Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses.

By installing the app on multiple systems, the attacker likely accumulated larger payouts.

Source: GreyNoise

Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide.

According to the researchers, the attacker leveraged several vulnerabilities to breach edge devices and install the Pawns.app software:

• CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS
• CVE-2021-44228 in Ubiquiti UniFi Video NVR
• CVE-2025-31324 in SAP NetWeaver Visual Composer

The researchers also observed targeting of Hikvision and Dahua DVR/NVR devices, but did not specify the vulnerabilities exploited in these systems.

GreyNoise says that, in some cases, the attackers configured SSH key authentication as a backup access method.

Configuring SSH access
Source: GreyNoise

Even legitimate proxy networks can route suspicious traffic through volunteer-operated nodes due to insufficient oversight, potentially resulting in IP address blocks for participating users or exposing them to allegations of involvement in illegal activities.

The FBI previously warned about such networks being used to carry out large-scale credential stuffing attacks against online platforms.

GreyNoise provides a free service (account required) for users to check if their IP address is part of a known legitimate or “gray” proxying service.

It is generally advisable to avoid downloading software from untrusted sources, as purportedly free software may contain malware that enrolls devices in residential proxy networks.

Threat actors also commonly exploit known vulnerabilities in internet-connected devices. Keeping NAS devices, video recorders, and other internet-facing systems updated can significantly reduce the risk of compromise.

However, users should also use strong credentials, a secure configuration, and restrict network access.

.article-callout { background-color: #f0f6ff; width: 95%; max-width: 800px; margin: 15px auto; border-radius: 8px; border: 1px solid #d6ddee; display: flex; align-items: stretch; overflow: hidden; } .article-media { flex: 1; max-width: 220px; display: flex; } .article-media a { display: flex; width: 100%; height: 100%; } .article-media img { width: 100%; height: 100%; border-radius: 8px 0 0 8px; display: block; } .article-callout .article-media img { margin-top: 0 !important; height: 100% !important; } .article-body { flex: 2; padding: 10px; display: flex; flex-direction: column; justify-content: center; } .article-body h2 { font-size: 17px !important; font-weight: 700; color: #333; line-height: 1.4; font-family: Georgia, "Times New Roman", Times, serif; margin: 0 0 14px 0; } .article-body p { font-weight: bold; font-size: 14px; margin: 0 0 clamp(6px, 2vw, 14px) 0; } .article-link { background-color: #fff; border: 1px solid #3b59aa; color: black; text-align: center; text-decoration: none; border-radius: 8px; display: inline-block; font-size: 16px; font-weight: bold; padding: 10px 20px; width: fit-content; } @media (max-width: 600px) { .article-callout { flex-direction: column; align-items: center; } .article-media { max-width: 100%; } .article-media img { border-radius: 8px 8px 0 0; } .article-body { padding: 15px; width: 100%; } .article-link { width: 100%; margin: 0 auto; box-sizing: border-box; } }

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Related Articles:

BragJack attacks hijack AI browser agents through malicious extensions

Japan's Digital Agency says VPN flaw exposed 246,000 personnel records

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

OpenAI admits it didn't disclose rogue AI wiki hijacking incident

Why Even the Best Edge Security Still Misses High-Risk Sessions