Proxyjacking Campaign Hijacks D-Link and Ubiquiti Devices

A proxyjacking campaign has compromised at least 143 devices across 34 countries, turning victims’ internet connections into revenue sources. The attacker installed legitimate bandwidth-sharing software without the owners’ permission and used their connections as residential proxy nodes.

Threat researchers at GreyNoise uncovered the operation while investigating suspicious activity at an unnamed organization. Their findings show how attackers can exploit internet-facing equipment to profit from its network access.

Attacker Installed Bandwidth-Sharing Software Without Consent

The operation used Pawns.app, a legitimate application that pays account holders for sharing their internet connections.

Under normal circumstances, users voluntarily allow third-party traffic to pass through their networks. In return, they receive compensation for providing suitable, accessible IP addresses.

However, this campaign bypassed that consent. The attacker installed the application on compromised systems, allowing someone else to collect the financial rewards.

By enrolling multiple devices, the operator could potentially increase those payouts. Nevertheless, the reported findings do not establish how much money the campaign generated.

Known Vulnerabilities Opened Access to Devices

According to GreyNoise, the attacker exploited several known vulnerabilities to gain access and deploy the software.

The affected products and identified flaws included:

• D-Link ShareCenter NAS: CVE-2024-3272 and CVE-2024-3273.
• Ubiquiti UniFi Video NVR: CVE-2021-44228, commonly known as Log4Shell.
• SAP NetWeaver Visual Composer: CVE-2025-31324.

Researchers also observed activity targeting Hikvision and Dahua video recording devices. However, they did not identify which vulnerabilities the attacker used against those systems.

In some cases, the operator additionally configured SSH key authentication as a backup access method. That step could provide another route into a compromised device.

Unwanted Proxy Traffic Creates Risks for Owners

The proxyjacking campaign did more than consume bandwidth without permission. It also allowed third-party traffic to leave the network through victims’ public IP addresses.

Consequently, suspicious activity could appear to originate from the connection owner, even when someone elsewhere initiated it.

Residential proxy services have legitimate uses. However, inadequate oversight can also allow customers to route abusive traffic through participating connections.

Potential consequences include IP address blocks and allegations linking owners to activity they did not authorize. Separately, the FBI has warned that attackers use residential proxies for large-scale credential-stuffing attempts against online services.

Those broader risks do not establish what traffic passed through the devices compromised in this particular operation.

Campaign Highlights Exposure of Internet-Facing Equipment

The findings illustrate how known security weaknesses can turn storage systems, video recorders and other connected equipment into unauthorized proxy infrastructure.

Accordingly, the incident reinforces the importance of software updates, strong credentials, secure configurations and restricted network access.

GreyNoise also offers an IP-checking service that requires a free account. It allows users to check whether their public address appears in a known legitimate or gray-market proxy service.

Ultimately, the defining feature of this operation was its misuse of legitimate software. The attacker supplied the compromised devices, while their owners unknowingly supplied the internet connections.