Hackers Hijack D-Link, Ubiquiti Devices to Resell Stolen Bandwidth

Threat Actor Turns Exposed NAS and NVR Devices Into a Bandwidth Resale Network

Threat intelligence firm GreyNoise has uncovered a global proxyjacking campaign that compromised at least 143 devices across 34 countries, silently enrolling them in a commercial residential proxy network to resell victims' internet bandwidth without consent. The attacker — tracked by GreyNoise under the handle skynox7 — exploited known vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver Visual Composer systems, then installed the legitimate bandwidth-sharing application Pawns.app on each compromised device, routing the proceeds to an attacker-controlled payout account.

GreyNoise discovered the campaign while running a live product demonstration for an organization that spotted GreyNoise-flagged malicious IP addresses inside its Entra ID sign-in logs. The addresses resolved to residential ranges and plausible geolocations for the organization's actual users — exactly the kind of traffic that normally slips past geolocation-based fraud checks.

Incident Details

How the Campaign Worked

Exploiting Known Edge-Device Vulnerabilities

Rather than developing novel exploits, the attacker relied entirely on previously disclosed vulnerabilities in internet-facing network and storage appliances:

• CVE-2024-3272 and CVE-2024-3273 — a hardcoded-credential flaw and a command-injection flaw, respectively, in D-Link ShareCenter NAS devices' nas_sharing.cgi component. Both were disclosed in 2024 and D-Link has stated several ShareCenter models are end-of-life and will not receive patches.
• CVE-2021-44228 — the infamous Log4Shell flaw — used against Ubiquiti UniFi Video NVR systems, demonstrating that four-year-old unpatched Log4j instances remain a live attack surface on consumer and SMB network video recorders.
• CVE-2025-31324 — an unauthenticated file-upload vulnerability in SAP NetWeaver Visual Composer that allows remote code execution, disclosed earlier in 2025 and already linked to multiple ransomware and espionage intrusions.
• Unspecified vulnerabilities were also observed being used against Hikvision and Dahua DVR/NVR devices, extending the campaign beyond the four named CVEs.

Installing a "Legitimate" App Without Consent

Once inside a device, the attacker didn't deploy traditional malware. Instead, they installed Pawns.app, a bandwidth-sharing application that normally pays consenting users for sharing idle internet capacity through a residential proxy network. IPRoyal has identified Pawns.app as a direct partner that supplies it with residential proxy endpoints.

The attacker ran the Pawns.app installer with command-line options that accept account credentials and device identifiers, tying each hijacked device's bandwidth to a payout account the attacker controlled rather than the device owner. GreyNoise published seven SHA-256 hashes of the Pawns.app binaries involved, while noting the binaries themselves are not inherently malicious — the crime is the unauthorized installation and bandwidth hijacking, not the software itself.

Backup Persistence via SSH Keys

In a number of compromises, the attacker went further than simply installing the proxy client: they also added SSH key-based authentication to the device as a backup access method. This gave the attacker a durable foothold independent of the proxy software, meaning removing Pawns.app alone would not fully evict them from an affected device.

Impact Assessment

Recommendations

For Device Owners and SMB Administrators

1. Patch or replace affected devices. Apply available firmware updates for D-Link ShareCenter, Ubiquiti UniFi Video, and SAP NetWeaver Visual Composer immediately. If a ShareCenter model is confirmed end-of-life and unpatched, plan for replacement — do not leave it internet-facing.
2. Take internet-facing admin panels offline. NAS, NVR, and DVR management interfaces should never be directly exposed to the internet. Place them behind a VPN or firewall-restricted management network.
3. Audit for unauthorized software. Check devices for an unexpected Pawns.app installation or any unfamiliar bandwidth-sharing client.
4. Review SSH authorized_keys files. Look for any attacker-added keys that were not provisioned by an administrator, and rotate credentials on any device that shows signs of compromise.
5. Check your IP reputation. GreyNoise offers a free lookup service that lets users check whether their IP address is associated with a known legitimate or "gray" proxying service.

For Security Teams and SOC Analysts

1. Scrutinize residential proxy traffic in authentication logs, especially sign-ins that pass geolocation checks but originate from known proxy/VPN ranges — do not rely on geolocation plausibility alone to clear suspicious logins.
2. Correlate anomalous behavioral indicators (login velocity, device fingerprint mismatches, unusual session patterns) rather than IP reputation in isolation, since proxyjacked residential IPs will often appear "clean."
3. Monitor for CVE-2021-44228 (Log4Shell) exploitation attempts against any still-deployed Ubiquiti UniFi Video or other Log4j-dependent appliances — this four-year-old flaw remains actively exploited in the wild.
4. Treat unexplained bandwidth-sharing or proxy clients on managed endpoints as a compromise indicator, not a policy violation to be quietly uninstalled — investigate for the installation vector and any added persistence (such as SSH keys) before remediating.

For End Users Participating in Bandwidth-Sharing Apps

1. Understand the risk of voluntary proxy apps. Even legitimate, opt-in bandwidth-sharing programs can carry your traffic alongside abuse traffic from compromised devices sharing the same network, due to limited vetting by proxy operators.
2. Monitor for unexplained bandwidth usage or unfamiliar account activity tied to bandwidth-sharing apps you did not knowingly install.

Key Takeaways

1. GreyNoise identified at least 143 devices across 34 countries hijacked into a proxyjacking scheme using the Pawns.app residential bandwidth-sharing app.
2. The attacker, tracked as skynox7, exploited CVE-2024-3272, CVE-2024-3273 (D-Link ShareCenter), CVE-2021-44228 (Log4Shell, Ubiquiti UniFi Video), and CVE-2025-31324 (SAP NetWeaver Visual Composer), plus unspecified flaws in Hikvision and Dahua DVR/NVR devices.
3. The campaign was discovered indirectly, through GreyNoise-flagged IPs appearing in an organization's Entra ID sign-in logs — a reminder that proxyjacked IPs can defeat geolocation-based authentication checks.
4. In some cases the attacker added SSH key-based persistence, so removing the proxy software alone does not guarantee eviction from a compromised device.
5. Several affected D-Link ShareCenter models are end-of-life and will not be patched, meaning replacement — not patching — is the only durable fix for those devices.
6. Security teams should treat residential-proxy traffic in authentication logs as a signal requiring behavioral analysis, not an automatic pass because the geolocation looks legitimate.

Sources

• GreyNoise — skynox7: Proxyjacking Edge Devices Into Residential Proxies
• BleepingComputer — Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
• GBHackers — New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure