# Hackers Hijack D-Link and Ubiquiti Devices for Proxyjacking Campaigns Attackers exploit known vulnerabilities to monetize stolen bandwidth through unauthorized proxy network installations. - **Source:** [Slashdot](https://brifing.si/source/0f34d58e-1ccd-45a6-ab82-2de4065dc7ad) - **Published:** 2026-10-16 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/9fb34808-eccb-4bbb-9725-70fb2c1f024e ## Global Proxyjacking Campaign Detected A sophisticated proxyjacking campaign has compromised devices across 34 countries, turning residential internet connections into commercial proxy nodes. Attackers are illicitly monetizing victim bandwidth by installing Pawns.app, a legitimate traffic-sharing application, without owner consent. This operation allows the threat actors to accumulate payouts by routing third-party traffic through these hijacked, non-blocking IP addresses. ## Exploitation of Known Vulnerabilities The attackers targeted specific hardware by exploiting known security flaws in D-Link ShareCenter NAS, specifically CVE-2024-3272 and CVE-2024-3273. Additionally, they leveraged the Ubiquiti UniFi Video NVR vulnerability CVE-2021-44228 and the SAP NetWeaver Visual Composer flaw CVE-2025-31324. These unpatched systems provided the necessary entry points for unauthorized software installation and persistent control. ## Broadening the Attack Surface Beyond D-Link and Ubiquiti hardware, the campaign extended to Hikvision and Dahua DVR/NVR devices. While the specific vulnerabilities used to breach these video surveillance systems remain unidentified, their inclusion indicates a broad targeting strategy. Attackers are actively scanning for vulnerable network-attached storage and video management hardware to expand their proxy network. ## Persistence Through SSH Authentication To maintain long-term access to the compromised systems, attackers configured SSH key authentication on several devices. This mechanism ensures that even if initial entry points are secured, the threat actors retain a backdoor for future operations. This persistence strategy highlights the attackers' focus on keeping their proxy nodes active for extended periods. ## Detection via Suspicious Activity Threat intelligence firm GreyNoise uncovered this campaign while investigating anomalous traffic patterns at an unnamed organization. Their analysis confirmed at least 143 compromised devices worldwide currently participating in the proxy network. This discovery emphasizes the importance of monitoring outbound traffic for unexpected connections to bandwidth-sharing services like the one utilized here. ## Mechanics of Bandwidth Monetization Pawns.app functions by rewarding users for sharing their internet connection with other network participants. By installing this software on numerous compromised systems, the attackers aggregate significant bandwidth capacity. Because the traffic originates from trusted residential IP addresses, it is less likely to be blocked by security filters, increasing its commercial value. ## Risk to Residential Networks Proxyjacking poses a severe risk to device owners, as their internet connections are used to facilitate potentially malicious or illegal traffic. When a device is hijacked, the owner remains responsible for the traffic flowing through their IP address. This can lead to blacklisting, service disruptions, and potential legal complications for the unsuspecting victims. ## Urgency of Patch Management This incident underscores the critical necessity of maintaining updated firmware on all network-connected devices. Relying on legacy hardware without active security patches leaves infrastructure vulnerable to automated exploitation. Organizations and home users must prioritize auditing their network devices for known vulnerabilities to prevent unauthorized use of their internet resources by attackers. ## Sources covering this story - https://it.slashdot.org/story/26/10/15/2315217/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth?utm_source=rss1.0mainlinkanon&utm_medium=feed — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._