Proxyjacking Campaign Hijacks 143 Devices to Resell Victims’ Bandwidth

Summary

GreyNoise identified a proxyjacking campaign affecting at least 143 devices in 34 countries. Attackers reportedly exploited vulnerabilities in edge devices to install Pawns.app and resell victims’ internet bandwidth.

Key points

GreyNoise found the campaign while investigating suspicious activity at an unnamed organization.
The attacker installed the legitimate bandwidth-sharing app Pawns.app without device owners’ consent.
Researchers identified at least 143 compromised devices across 34 countries.
Reportedly exploited flaws include CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer.
The campaign also targeted Hikvision and Dahua DVR/NVR devices, but GreyNoise did not specify the vulnerabilities used against them.
In some cases, attackers configured SSH key authentication as a backup access method.
GreyNoise warns that proxy networks can route suspicious traffic through users’ connections; it recommends updating internet-facing devices, using strong credentials and secure configurations, and restricting network access.

Article Details

Event Type: Proxyjacking campaign exploiting vulnerable internet-connected devices
Impact: GreyNoise identified at least 143 compromised devices across 34 countries. The attacker installed Pawns.app without device owners’ consent to route other users’ traffic through victims’ internet connections and monetize their bandwidth. GreyNoise reported that SSH key authentication was configured as a backup access method in some cases. Victims may face IP address blocks or allegations of involvement in illegal activity because suspicious traffic can pass through residential proxy nodes.