As reported by BleepingComputer, GreyNoise has uncovered a proxyjacking operation spanning 34 countries that hijacks internet-facing edge devices — primarily D-Link NAS units, Ubiquiti UniFi NVRs, SAP NetWeaver instances, and Hikvision/Dahua DVRs — to silently enroll them in the Pawns.app residential proxy network. The attacker monetizes the victims' bandwidth by accumulating payouts across multiple compromised nodes, all without device owners' knowledge or consent.
Why This Campaign Matters
Proxyjacking sits at an uncomfortable intersection of legality and abuse. Pawns.app is a legitimate commercial service, not malware in the traditional sense. What makes this malicious is the deployment method — the application is installed without authorization on systems the attacker does not own, using vulnerability exploitation rather than user consent. This creates a pernicious threat model: defenders cannot simply blocklist a malicious binary or C2 domain, because the traffic itself flows through a sanctioned commercial platform.
The economic incentives are straightforward and scalable. Each compromised device generates passive income for the attacker. With 143 confirmed nodes across 34 countries — and that figure almost certainly representing a fraction of the true footprint — the operator has built a distributed bandwidth-rental business on other people's hardware and electricity.
Vulnerability Profile
The campaign exploits a mix of well-documented and newer CVEs across multiple vendor ecosystems. The common denominator is internet-exposed edge infrastructure that organizations have failed to patch or decommission.
| CVE | Affected Product | Severity | Patch Status |
|---|---|---|---|
| CVE-2024-3272 | D-Link ShareCenter NAS | Critical (9.8) | Firmware updates available; many affected models are EOL |
| CVE-2024-3273 | D-Link ShareCenter NAS | High (8.8) | Firmware updates available; many affected models are EOL |
| CVE-2021-44228 (Log4Shell) | Ubiquiti UniFi Video NVR | Critical (10.0) | Patched by Ubiquiti; NVR product line has been discontinued |
| CVE-2025-31324 | SAP NetWeaver Visual Composer | Critical | Patch available via SAP Security Note |
The presence of Log4Shell — a vulnerability publicly known since December 2021 — in the attacker's toolkit is telling. It demonstrates that threat actors continue to successfully exploit flaws that are years old, betting correctly that a significant population of organizations still run unpatched or end-of-life network appliances. The targeting of Hikvision and Dahua DVRs, for which specific CVEs were not disclosed, reinforces that IoT-class surveillance hardware remains a persistent soft target.
Operational Persistence
GreyNoise observed that the attacker configured SSH key-based authentication on compromised hosts as a redundant access mechanism. This is a standard but effective persistence technique — even if the initial exploit path is later patched, the attacker retains a credential-based foothold that won't be cleared by a firmware update alone. Defenders who apply patches without also auditing SSH authorized_keys and user accounts will miss this backdoor.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Inventory and patch all edge devices. Prioritize any internet-facing NAS, NVR, or NetWeaver instance. Verify against vendor advisories for each CVE listed above.
- Audit SSH configuration on all perimeter devices. Review
~/.ssh/authorized_keysand/etc/ssh/for unauthorized keys. Disable SSH where not required; enforce key-only authentication with passphrase-protected keys where it is. - Remove Pawns.app and similar bandwidth-sharing software (e.g., Honeygain, EarnApp, Repocket) from any system where it was not explicitly and knowingly installed by an authorized user.
- Check IP reputation. Use GreyNoise's free lookup tool to determine if your public IP has been flagged as part of a residential proxy network. Unexpected proxy classification is a strong indicator of compromise.
- Isolate IoT and surveillance networks. NVRs and DVRs should not be directly exposed to the internet. Use VPN or a jump host for remote access to camera management interfaces.
Longer-Term Hardening
- Establish a lifecycle policy for network appliances. Devices that have reached end-of-life and no longer receive patches should be retired or segmented into restricted VLANs with no inbound internet exposure.
- Deploy network-level monitoring for outbound traffic anomalies — sustained unexpected outbound connections from NAS or NVR subnets are a behavioral indicator of proxyjacking.
- Block residential proxy egress at the network perimeter. Maintain blocklists for known residential proxy provider IP ranges if business policy does not require legitimate use of those services.
- Review SAP NetWeaver exposure urgently. If CVE-2025-31324 affects your environment, treat it as an active exploitation risk — the fact that proxyjacking operators are targeting it suggests broader interest from other threat actors as well.
The broader takeaway: proxyjacking campaigns blur the line between nuisance malware and serious infrastructure abuse. Compromised devices don't just leak bandwidth — they expose their IP addresses to potential blocklisting, entangle owners in law enforcement inquiries when proxy traffic is used for criminal activity, and provide persistent footholds that attackers can repurpose for future campaigns. Treat any unauthorized residential proxy software installation as a confirmed breach requiring full incident response, not merely a cleanup task.
