Hackers Hijack D-Link and Ubiquiti Devices for Proxyjacking Campaigns
Attackers exploit known vulnerabilities to monetize stolen bandwidth through unauthorized proxy network installations.
1Global Proxyjacking Campaign Detected
A sophisticated proxyjacking campaign has compromised devices across 34 countries, turning residential internet connections into commercial proxy nodes. Attackers are illicitly monetizing victim bandwidth by installing Pawns.app, a legitimate traffic-sharing application, without owner consent. This operation allows the threat actors to accumulate payouts by routing third-party traffic through these hijacked, non-blocking IP addresses.
2Exploitation of Known Vulnerabilities
The attackers targeted specific hardware by exploiting known security flaws in D-Link ShareCenter NAS, specifically CVE-2024-3272 and CVE-2024-3273. Additionally, they leveraged the Ubiquiti UniFi Video NVR vulnerability CVE-2021-44228 and the SAP NetWeaver Visual Composer flaw CVE-2025-31324. These unpatched systems provided the necessary entry points for unauthorized software installation and persistent control.
3Broadening the Attack Surface
Beyond D-Link and Ubiquiti hardware, the campaign extended to Hikvision and Dahua DVR/NVR devices. While the specific vulnerabilities used to breach these video surveillance systems remain unidentified, their inclusion indicates a broad targeting strategy. Attackers are actively scanning for vulnerable network-attached storage and video management hardware to expand their proxy network.
4Persistence Through SSH Authentication
To maintain long-term access to the compromised systems, attackers configured SSH key authentication on several devices. This mechanism ensures that even if initial entry points are secured, the threat actors retain a backdoor for future operations. This persistence strategy highlights the attackers' focus on keeping their proxy nodes active for extended periods.
5Detection via Suspicious Activity
Threat intelligence firm GreyNoise uncovered this campaign while investigating anomalous traffic patterns at an unnamed organization. Their analysis confirmed at least 143 compromised devices worldwide currently participating in the proxy network. This discovery emphasizes the importance of monitoring outbound traffic for unexpected connections to bandwidth-sharing services like the one utilized here.
6Mechanics of Bandwidth Monetization
Pawns.app functions by rewarding users for sharing their internet connection with other network participants. By installing this software on numerous compromised systems, the attackers aggregate significant bandwidth capacity. Because the traffic originates from trusted residential IP addresses, it is less likely to be blocked by security filters, increasing its commercial value.
7Risk to Residential Networks
Proxyjacking poses a severe risk to device owners, as their internet connections are used to facilitate potentially malicious or illegal traffic. When a device is hijacked, the owner remains responsible for the traffic flowing through their IP address. This can lead to blacklisting, service disruptions, and potential legal complications for the unsuspecting victims.
8Urgency of Patch Management
This incident underscores the critical necessity of maintaining updated firmware on all network-connected devices. Relying on legacy hardware without active security patches leaves infrastructure vulnerable to automated exploitation. Organizations and home users must prioritize auditing their network devices for known vulnerabilities to prevent unauthorized use of their internet resources by attackers.
Original article: Slashdot — Hackers Hijack D-Link and Ubiquiti Devices for Proxyjacking Campaigns