Pawns.app (Product): news timeline & CVEs

Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks

Actor skynox7 exploited D-Link, Ubiquiti, and SAP flaws to proxyjack 143 devices.

GreyNoise says an actor tracked as skynox7 compromised at least 143 devices in 34 countries by exploiting D-Link ShareCenter, Ubiquiti UniFi Video, and SAP NetWeaver Visual Composer flaws, then installing Pawns.app to turn them into residential proxy nodes. The flaws are CVE-2024-3272 and CVE-2024-3273, CVE-2021-44228, and CVE-2025-31324. On some devices the actor also installed SSH keys for persistent access. GreyNoise notes the binaries are not inherently malware, but they were installed without consent; Hikvision and Dahua targeting was not confirmed as successful.

Cyber Security NewsOct 16, 09:02 UTC · 18h agoExploit / PoC in the wild 4 sources CVE-2021-44228 CVE-2024-3272 CVE-2024-3273+1 CVEs1

New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure

GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.

GreyNoise disclosed a proxyjacking campaign that compromised at least 143 devices in 34 countries by exploiting network and enterprise software flaws. The attacker used CVE-2024-3272 and CVE-2024-3273 on D-Link ShareCenter NAS devices, CVE-2021-44228 on Ubiquiti UniFi Video, and CVE-2025-31324 on SAP NetWeaver Visual Composer, then installed the legitimate Pawns.app bandwidth-sharing client without consent. Hikvision and Dahua recorders were also targeted, though the vulnerabilities used were not identified. In some cases SSH keys were added for backup access. GreyNoise says the activity monetizes victims' bandwidth as residential proxy infrastructure and is not attributed to a named operator.

GBHackersupdated Oct 16, 09:02 UTC · 18h agofirst Oct 16, 05:54 UTC · 21h agoExploit / PoC in the wild 4 sources CVE-2021-44228 CVE-2024-3272

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.

GreyNoise reported a proxyjacking campaign that compromised at least 143 devices in 34 countries and installed Pawns.app, a legitimate bandwidth-sharing app, without owners’ consent. Attackers exploited CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter, CVE-2021-44228 in Ubiquiti UniFi Video, and CVE-2025-31324 in SAP NetWeaver Visual Composer, and also targeted Hikvision and Dahua recorders. In some cases they configured SSH key authentication for persistent access. Residential proxy traffic can get victims’ IPs blocked or tied to abuse such as credential stuffing.

BleepingComputerupdated Oct 16, 09:02 UTC · 18h agofirst Oct 15, 18:20 UTC · 1d agoMalware in the wild 4 sources CVE-2024-3272 CVE-2024-3273

skynox7: Proxyjacking Edge Devices Into Residential Proxies

An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.

GreyNoise identified a malicious actor, tracked as skynox7, proxyjacking network edge devices by installing Pawns.app residential proxy software. The actor compromised at least 143 devices in 34 countries using D-Link ShareCenter flaws CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324. Hikvision and Dahua DVR/NVR devices were also targeted, and some victims received attacker SSH keys for backup access. Residential proxy exits let malicious traffic appear to come from plausible user locations.

GreyNoiseupdated Oct 16, 09:02 UTC · 18h agofirst Oct 15, 00:00 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2024-3272 CVE-2024-3273 CVE-2021-44228

Pawns.app

Timeline4 articles

Related CVEsby mentions

Appears with

Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks

New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

skynox7: Proxyjacking Edge Devices Into Residential Proxies