D-Link and Ubiquiti devices hijacked by hackers to loot stolen bandwidth
- Attackers took advantage of vulnerable devices to install legitimate bandwidth-sharing software and hijack Internet connections.
- Compromised systems were covertly added to proxy networks, enabling anonymous criminal activity.
- The campaign affected at least 143 devices in 34 countries, highlighting flaws in patching and access control.
When threat actors break into a system, they don’t need to install malware to make use of the compromised endpoint: they can install normal, perfectly legal software and still walk away with a paycheck they didn’t earn.
A recent proxyjacking campaign detected by security researchers GreyNoise affected hundreds of devices in dozens of countries.
kidnapping of powers
Proxyjacking is a type of attack in which a device is hijacked and assimilated into a proxy network. Typically, cybercriminals break into a computer, install malware, and create their own proxy network, which they can then rent or use themselves. Threat actors always need “clean,” unmarked devices and IP addresses they can hide behind, making residential proxies, both malicious and legal, highly sought after services.
Latest videos ofTechnologyRadar
Some of the major malicious residential proxies out there are IPIDEA, NetNut, and Cloudrouter. All of them are now either completely decommissioned or severely disrupted, but while they were operational, they offered hundreds of thousands (sometimes millions) of IP addresses associated with an Internet connection used in a home (hence the name “residential IP address”).
But malicious proxies are difficult to achieve. To assimilate a device into the network, the threat actor needs to deploy malware which, as soon as it is detected, will be flagged and quarantined by antivirus products. In the most recent attacks, detected by GreyNoise, someone opted for a legitimate app with similar functionality.
Investigators found someone installing Pawns.app, primarily a rewards platform that allows users to earn money by completing online surveys and playing games. However, it used to offer a bandwidth sharing feature that allowed users to earn money by allowing business customers to route their Internet traffic through the user’s home IP address. Earlier this year, the app discontinued the feature, but it appears to still work in older versions.
“As of 2026, Pawns.app does not offer Internet bandwidth sharing,” reads a notification on the app’s website. “This feature has been discontinued and is no longer associated with Pawns.app.” But the app’s Terms of Use still describe traffic sharing as available in some versions of the app, and its commercial website still promotes an SDK for bandwidth monetization.
Targeting D-Link
Apparently someone noticed this and got to work. According to GreyNoise, they targeted D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver Visual Composers devices. These contained different vulnerabilities: CVE-2024-3272 and CVE-2024-3273 for D-Link, CVE-2021-44228 for Ubiquiti and
CVE-2025-31324 for SAP, which the threat actor exploited to implement Pawns.app. GreyNoise also said that the attackers targeted Hikvision and Dahua DVR/NVR devices, but did not say what vulnerabilities they exploited against these devices.
At the time of publication, researchers identified at least 143 compromised devices worldwide, located in 34 different countries. While they all had legitimate software installed, it was implemented without their knowledge or consent, making the entire experience illegal.
“While ‘making money online’ is voluntary, proxyjacking is a crime. Proxyjacking occurs when a MCA (malicious cyber actor) forces victims’ devices into proxy networks to monetize their bandwidth,” GreyNoise warned.
If you’re worried that someone has done something similar to a device under your control, GreyNoise created a free service that allows you to check if your IP has interacted with your Global Observation Grid. The researchers said it can serve as a potential indicator of proxyjacking.
In addition to scanning IP addresses, companies should educate employees about the risks associated with installing free apps, as well as the importance of keeping devices patched. They should also detect residential proxy IP addresses in authentication logs, as well as deviations in user authentication behavior and characteristics beyond geolocation, such as discrepancies in device identifiers or session identifiers.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment