Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

A newly uncovered proxyjacking operation has compromised at least 143 internet-facing devices across 34 countries, secretly turning victims' bandwidth into profit for the attacker through a commercial residential proxy service. GreyNoise researchers found that the intruder covertly installs Pawns.app, a legitimate bandwidth-sharing tool, on hijacked systems without the owners' knowledge, collecting payouts meant for consenting users. To gain access, the attacker abused flaws including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer, while also probing Hikvision and Dahua recorders. In some cases SSH keys were added for persistent backup access. Beyond stolen bandwidth, affected device owners risk IP blacklisting or being wrongly associated with abuse carried out through their connections, underscoring the need to patch exposed NAS and video-recording equipment promptly.