Hackers use D-Link and Ubiquiti devices to steal and resell home internet bandwidth

How hackers turned home devices into money-making tools

Researchers at GreyNoise have found that hackers have been taking over D-Link and Ubiquiti devices in at least 34 countries. The attackers used known security flaws to break into these devices and install a program called Pawns.app. This app is usually legitimate and allows people to earn money by sharing their internet connection. In this case, though, the software was installed without the owners’ knowledge or consent, making the activity illegal. The attackers then used the victims’ internet connections as part of a commercial proxy network, which lets others route their internet traffic through these hijacked devices. This process is called proxyjacking.

What is proxyjacking and why does it matter?

Proxyjacking is when someone secretly forces your device to share its internet connection with strangers, usually for profit. While some people choose to share their bandwidth through apps like Pawns.app, in this campaign the device owners had no idea it was happening. This can put them at risk. For example, if someone uses your internet connection for illegal activity, you could be blamed. Your internet speed and data limits could also be affected. GreyNoise, the company that discovered the attack, warns that even legitimate proxy networks can be abused for suspicious or illegal activity, and that users whose IP addresses are linked to such networks may face blocks or accusations.

The vulnerabilities used to break in

The attackers exploited several known vulnerabilities (security flaws) to take control of the devices. For D-Link ShareCenter NAS (Network Attached Storage) devices, they used CVE-2024-3272 and CVE-2024-3273. For Ubiquiti UniFi Video NVR (Network Video Recorder) devices, they used CVE-2021-44228. SAP NetWeaver Visual Composer systems were also targeted using CVE-2025-31324. In some cases, the attackers set up SSH key authentication, which could let them access the device again later. The campaign also targeted Hikvision and Dahua video recorders, but it’s not clear which vulnerabilities were used in those cases.BleepingComputer↗ (opens in a new tab) TechRadar↗ (opens in a new tab)

How many devices are affected and where?

GreyNoise identified at least 143 compromised devices, spread across 34 countries. The real number could be higher, since not all affected devices may have been detected. The researchers first noticed the attack while investigating unusual activity at an unnamed organisation. They traced the activity back to the installation of Pawns.app on devices that had been breached using the vulnerabilities described above.

What can users and businesses do?

GreyNoise offers a free service (with an account) to check if your IP address is part of a known proxy network. If you think your device might be affected, you should check for unexpected software and review your device’s settings. It’s important to keep all internet-connected devices updated with the latest security patches. Use strong passwords and avoid downloading software from untrusted sources. Businesses should also educate staff about the risks of free software and monitor their networks for signs of unusual proxy activity, such as unexpected IP addresses in authentication logs or changes in device behaviour.

The bigger picture: risks of residential proxy networks

Residential proxy networks use the internet connections of ordinary people to route traffic for paying customers. While some users join these networks on purpose, attackers can force devices into these networks without consent, as seen in this campaign. The FBI has previously warned that such networks can be used to hide large-scale cyberattacks, like credential stuffing (using stolen usernames and passwords to break into accounts). Even if the software is legitimate, installing it without the owner’s knowledge is illegal and can have serious consequences for victims.