Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
Actor skynox7 exploited D-Link, Ubiquiti, and SAP flaws to proxyjack 143 devices.
GreyNoise says an actor tracked as skynox7 compromised at least 143 devices in 34 countries by exploiting D-Link ShareCenter, Ubiquiti UniFi Video, and SAP NetWeaver Visual Composer flaws, then installing Pawns.app to turn them into residential proxy nodes. The flaws are CVE-2024-3272 and CVE-2024-3273, CVE-2021-44228, and CVE-2025-31324. On some devices the actor also installed SSH keys for persistent access. GreyNoise notes the binaries are not inherently malware, but they were installed without consent; Hikvision and Dahua targeting was not confirmed as successful.
75