- Hackers exploited vulnerable D Link, Ubiquiti and other devices to install bandwidth sharing software without the owners’ consent.
- GreyNoise identified at least 143 compromised devices across 34 countries in the reported proxyjacking campaign.
- Attackers used Pawns.app, a legitimate rewards platform whose former bandwidth sharing feature may remain functional in older versions.
- Businesses should patch vulnerable devices, restrict remote access, monitor network traffic and investigate suspicious authentication activity.
Cybercriminals are finding new ways to make money from compromised devices, and their latest approach does not necessarily require conventional malware. Instead, attackers are exploiting vulnerable network equipment to install legitimate software that can turn an unsuspecting victim’s internet connection into a resource for profit.
A recent campaign identified by cybersecurity researchers at GreyNoise targeted network attached storage devices, video surveillance systems and enterprise software across multiple countries. The attackers installed Pawns.app, a rewards platform that previously offered a feature allowing users to earn money by sharing their internet bandwidth.
The campaign highlights an increasingly difficult challenge for cybersecurity teams. Software does not have to be inherently malicious to become part of a cyberattack. When criminals install legitimate applications on devices without the owner’s knowledge or permission, they can misuse those applications while potentially avoiding some of the security alerts associated with traditional malware.
GreyNoise identified at least 143 compromised devices across 34 countries at the time of reporting. The findings suggest that poorly secured internet connected equipment remains an attractive target for attackers looking to generate revenue with relatively little effort.
What Is Proxyjacking and How Does It Work?
Proxyjacking occurs when attackers take control of a device’s internet connection and add it to a proxy network without the owner’s consent. These networks allow third parties to route their internet traffic through another person’s device and residential IP address.
Residential IP addresses can be valuable because online services often treat traffic from household internet connections differently from traffic originating from commercial data centres. Criminals can exploit this distinction to conceal the origin of their activity, while legitimate businesses may use residential proxies for purposes such as market research, advertising verification and regional testing.
In a typical proxyjacking attack, criminals compromise a device, install software that enables traffic sharing and connect it to a network that can be used by other parties. The device owner may not notice anything unusual, particularly if the application operates quietly in the background.
The consequences can extend beyond the unauthorised use of bandwidth. Victims could experience slower internet speeds, increased network usage or unexpected resource consumption. More importantly, suspicious activity routed through their IP address could attract unwanted attention from websites, online platforms or security teams.
The latest campaign stands out because it relies on Pawns.app, a legitimate rewards application, rather than an obviously malicious program.
D-Link, Ubiquiti and Other Devices Under Attack
According to GreyNoise, the attackers targeted several types of network equipment and enterprise systems, exploiting known vulnerabilities to deploy the bandwidth sharing software.
The affected products included D-Link ShareCenter network attached storage devices, Ubiquiti UniFi Video network video recorders and SAP NetWeaver Visual Composer systems. Hikvision and Dahua digital video recorders and network video recorders were also among the devices targeted during the campaign.
The vulnerabilities identified in the reported attacks include CVE 2024 3272 and CVE 2024 3273 affecting certain D-Link devices, CVE 2021 44228 associated with the Apache Log4j vulnerability affecting relevant software environments, and CVE 2025 31324 affecting SAP NetWeaver.
The specific vulnerabilities involved can differ by product and software configuration. Their presence in the campaign reinforces the importance of applying relevant security updates and restricting access to exposed administrative interfaces.
Organisations should not assume that installing a legitimate application means a compromised device is safe. The central issue is whether the software was installed with authorisation and whether the device has been exposed to an attacker.
The campaign also illustrates why older network attached storage and surveillance products deserve attention. Devices that remain connected to the internet for years can become overlooked entry points when their firmware is outdated or their security controls are no longer adequate.
Pawns.app Raises Questions About Bandwidth Sharing
Pawns.app was used in the campaign because of its former bandwidth sharing functionality, which allowed users to earn rewards by permitting business clients to route traffic through their internet connections.
The company has stated that internet bandwidth sharing was discontinued in 2026 and is no longer associated with the service. However, the reported findings indicate that older versions may still support the functionality. The company’s terms and business materials have also continued to describe aspects of traffic sharing and bandwidth monetisation.
This distinction matters because the application itself is not necessarily malware. The attack involves exploiting vulnerable devices and installing software without the owner’s permission. A legitimate program can still become a tool for criminal activity when it is deployed through unauthorised access.
GreyNoise warned that voluntary bandwidth sharing and proxyjacking are fundamentally different. In the former, a user knowingly agrees to share their connection under the service’s terms. In the latter, criminals make that decision on the victim’s behalf.
For individuals and businesses, the immediate priority is to establish whether any device has been compromised, rather than relying solely on the reputation of the software found on it.
How to Protect Devices Against Proxyjacking
Organisations should begin by identifying internet facing devices, checking their firmware versions and applying security updates wherever available. Unsupported products should be evaluated for replacement, particularly if they expose administrative services directly to the internet.
Administrators should also disable unnecessary remote access, change default credentials, use strong authentication and restrict management interfaces to trusted networks. Network monitoring can help identify unexpected outbound connections, unfamiliar processes and unusual bandwidth consumption.
Security teams should review authentication logs for suspicious residential proxy activity and investigate unusual login patterns. Changes in device identifiers, session characteristics and access behaviour can provide useful warning signs even when an IP address appears legitimate.
GreyNoise has also provided a service that allows users to check whether their IP address has interacted with its Global Observation Grid. Such a check can offer a potential indicator of suspicious activity, but it cannot conclusively establish whether a device has been compromised. A negative result does not guarantee that a network is clean.
Employees should be reminded not to install unapproved software on company equipment. Network attached storage devices, surveillance recorders and other specialised hardware should be included in routine security assessments rather than treated as low risk simply because they are not traditional computers.
The broader lesson is clear: attackers do not always need sophisticated malware to turn a compromised system into a source of income. In some cases, exploiting an outdated device and quietly installing legitimate software is enough to misuse a victim’s internet connection. Regular patching, restricted access and effective monitoring remain essential defences against this evolving threat.
Follow TechBSB For More Updates
