Hackers hijacked D-Link and Ubiquiti devices in 34 countries and targeted Hikvision recorders to resell owners’ bandwidth

GreyNoise, the threat-intelligence firm, has traced a proxyjacking campaign to at least 143 compromised devices spread across 34 countries. The attacker broke into D-Link and Ubiquiti gear, went after Hikvision and Dahua recorders, and quietly installed a paid bandwidth-sharing app so that the owners’ internet connections could be rented out to strangers.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

GreyNoise published its findings on October 15, 2026, after stumbling on the activity while investigating something else. The report names the actor skynox7 and says the campaign turned ordinary storage and video gear into paying nodes for a residential proxy service, a business model that rewards whoever controls the most devices.

What GreyNoise found on 143 devices

According to GreyNoise’s write-up, titled “skynox7: Proxyjacking Edge Devices Into Residential Proxies,” the actor compromised at least 143 devices in 34 countries and installed Pawns.app on them without the owners’ consent. BleepingComputer, which covered the report, says GreyNoise noticed the campaign while looking into suspicious activity at an unnamed organization.

The targets were the unglamorous boxes that sit on a network and rarely get updated: D-Link ShareCenter network-attached storage, Ubiquiti UniFi Video network video recorders, and SAP NetWeaver Visual Composer servers. GreyNoise also saw signs that the actor was going after DVR and NVR recorders from Hikvision and Dahua, though it did not say which vulnerabilities were used against them, so those two brands are described as targeted rather than confirmed as hijacked. The distinction matters for owners: a recorder bought from any of these makers is a candidate for the same treatment if it is reachable from the internet and unpatched, whether or not GreyNoise logged a successful break-in on that exact model.

The bugs used to break in

GreyNoise tied the intrusions to four known flaws. Two, CVE-2024-3272 and CVE-2024-3273, affect D-Link ShareCenter storage. A third, CVE-2021-44228, is the Log4Shell flaw in Apache Log4j2, which the National Vulnerability Database rates 10.0 on the critical scale and which was published on December 10, 2021. GreyNoise says the actor used it against Ubiquiti’s UniFi Video recorder. The record shows the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on the day it was published, with a December 24, 2021 deadline for federal agencies to patch, so an unpatched recorder in 2026 is running nearly five-year-old exposure.

The fourth, CVE-2025-31324, is an unrestricted file-upload flaw in SAP NetWeaver Visual Composer that lets an unauthenticated user upload executable binaries; NIST scored it 9.8 and SAP scored it 10.0 when it was published on April 24, 2025. None of these is new. The campaign works because exposed devices that never received patches stay reachable long after fixes ship, which is the pattern edge-device attackers have exploited for years. In some cases the actor also configured the victim devices to accept SSH key authentication, giving a second way back in even if the original flaw was fixed or the app was removed. GreyNoise’s post lists indicators for defenders, including seven file hashes for the Pawns.app installer and the address the exploitation traffic came from.

How Pawns.app turns bandwidth into cash

Pawns.app is a commercial service. BleepingComputer describes it as a legitimate application that lets users earn money by sharing their internet connections, and that pays for relaying other customers’ traffic through trusted, non-blocking IP addresses. GreyNoise’s analysis says the software is a rebrand of IPRoyal Pawns, owned by the same people and a direct partner of IPRoyal, and that it accepts a username, password and device information at runtime, which makes installing it on someone else’s machine straightforward. The post states that the software is not necessarily malware unless it is installed without consent, and here it was.

The attacker likely earned more by putting the app on many systems at once, since each hijacked device adds another connection that can be sold. The cost lands on the owner, whose address can end up blocked or tied to someone else’s traffic, and whose network now carries strangers’ sessions that a business or household never agreed to host. Legitimate proxy networks can route suspicious traffic through participants’ addresses, which may get their IPs blocked or expose them to allegations of illegal activity.

The risk predates this campaign. The FBI warned in 2022, in an alert reported by BleepingComputer, that criminals use residential proxies to run large-scale credential-stuffing attacks that evade tracking and blocking, and that attackers obtain the proxies by compromising home devices such as modems or Internet of Things gear. The 2022 notice described residential addresses as unlikely to appear on blocklists, which is the same property that makes a hijacked recorder valuable to whoever resells the connection, and the same reason a defender cannot simply block the address and move on.

BleepingComputer’s advice to owners is plain: keep NAS devices, video recorders and other internet-facing systems updated, use strong credentials and restricted network access, and avoid downloading free software from untrusted sources. GreyNoise also offers a free tool, which requires an account, to check whether an IP address belongs to a known legitimate or gray proxy service.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.