Key points
- GreyNoise identified 143 compromised devices in a global campaign using Pawns.app.
- Exploited flaws include CVE-2024-3272/3273 in D-Link NAS and CVE-2025-31324 in SAP.
- Ubiquiti UniFi Video NVRs were targeted via CVE-2021-44228; Hikvision and Dahua also hit.
GreyNoise researchers discovered a proxyjacking campaign that has compromised at least 143 devices across 34 countries. The attackers installed Pawns.app, a legitimate bandwidth-sharing application, on these systems without owner consent. This software allows users to earn money by sharing their internet connection, but in this case, it was used to monetize stolen bandwidth.
In plain English
The threat actor, tracked as skynox7, turned victim devices into residential proxy nodes. This means internet traffic from other users flows through the compromised hardware, using the victims' real IP addresses. This technique helps attackers hide their location and blend in with normal user traffic, making suspicious activity harder to detect.
The background
GreyNoise linked the campaign to specific vulnerabilities in network equipment. D-Link ShareCenter NAS devices were breached via CVE-2024-3272 and CVE-2024-3273. Ubiquiti UniFi Video NVRs were targeted using CVE-2021-44228. SAP NetWeaver Visual Composer was affected by CVE-2025-31324 in its Metadata Uploader component. Hikvision and Dahua DVR/NVR devices were also targeted, though specific flaws were not detailed.
What changes now
Administrators must verify if their specific models and firmware versions are affected. The FBI has previously warned that such networks can facilitate credential stuffing attacks. GreyNoise offers a free service to check if an IP address is part of a known proxying service. Users should avoid downloading software from untrusted sources, as free apps may contain malware that enrolls devices in these networks.
Who needs to act first
Teams should prioritize updating internet-facing systems that handle storage or video surveillance. Check whether your network allows outbound connections to unknown proxy services. Roll out configuration changes that restrict access to management interfaces. Back up device settings before applying any updates. If no fix exists, isolate affected segments to prevent lateral movement. Monitor logs for unusual outbound traffic patterns that might indicate unauthorized proxy usage.
What to do and how to stay safe: D-Link
- Check if your IP address is listed in GreyNoise's proxy database using their free service.
- Update D-Link, Ubiquiti, and SAP systems to the latest firmware versions available from vendors.
- Remove Pawns.app or any unknown bandwidth-sharing applications from your network devices.
- Restrict network access to management ports and enforce strong credentials on all edge devices.
Step-by-step guide: How Passkeys Work: The Cryptographic Mechanics Behind Passwordless Login
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific devices are affected by this campaign?
D-Link ShareCenter NAS, Ubiquiti UniFi Video NVRs, SAP NetWeaver Visual Composer, and Hikvision and Dahua DVR/NVR devices were targeted.
What software was installed on the compromised devices?
Attackers installed Pawns.app, a legitimate bandwidth-sharing application, without the owners' consent.
Is there a confirmed patch for all vulnerabilities?
The source material does not confirm that patches exist for all listed CVEs; check vendor guidance for specific fixes.
