SAP NetWeaver Visual Composer (Product): news timeline & CVEs

Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks

Actor skynox7 exploited D-Link, Ubiquiti, and SAP flaws to proxyjack 143 devices.

GreyNoise says an actor tracked as skynox7 compromised at least 143 devices in 34 countries by exploiting D-Link ShareCenter, Ubiquiti UniFi Video, and SAP NetWeaver Visual Composer flaws, then installing Pawns.app to turn them into residential proxy nodes. The flaws are CVE-2024-3272 and CVE-2024-3273, CVE-2021-44228, and CVE-2025-31324. On some devices the actor also installed SSH keys for persistent access. GreyNoise notes the binaries are not inherently malware, but they were installed without consent; Hikvision and Dahua targeting was not confirmed as successful.

Cyber Security NewsOct 16, 09:02 UTC · 17h agoExploit / PoC in the wild 4 sources CVE-2021-44228 CVE-2024-3272 CVE-2024-3273+1 CVEs1

New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure

GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.

GreyNoise disclosed a proxyjacking campaign that compromised at least 143 devices in 34 countries by exploiting network and enterprise software flaws. The attacker used CVE-2024-3272 and CVE-2024-3273 on D-Link ShareCenter NAS devices, CVE-2021-44228 on Ubiquiti UniFi Video, and CVE-2025-31324 on SAP NetWeaver Visual Composer, then installed the legitimate Pawns.app bandwidth-sharing client without consent. Hikvision and Dahua recorders were also targeted, though the vulnerabilities used were not identified. In some cases SSH keys were added for backup access. GreyNoise says the activity monetizes victims' bandwidth as residential proxy infrastructure and is not attributed to a named operator.

GBHackersupdated Oct 16, 09:02 UTC · 17h agofirst Oct 16, 05:54 UTC · 20h agoExploit / PoC in the wild 4 sources CVE-2021-44228 CVE-2024-3272

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.

GreyNoise reported a proxyjacking campaign that compromised at least 143 devices in 34 countries and installed Pawns.app, a legitimate bandwidth-sharing app, without owners’ consent. Attackers exploited CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter, CVE-2021-44228 in Ubiquiti UniFi Video, and CVE-2025-31324 in SAP NetWeaver Visual Composer, and also targeted Hikvision and Dahua recorders. In some cases they configured SSH key authentication for persistent access. Residential proxy traffic can get victims’ IPs blocked or tied to abuse such as credential stuffing.

BleepingComputerupdated Oct 16, 09:02 UTC · 17h agofirst Oct 15, 18:20 UTC · 1d agoMalware in the wild 4 sources CVE-2024-3272 CVE-2024-3273

skynox7: Proxyjacking Edge Devices Into Residential Proxies

An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.

GreyNoise identified a malicious actor, tracked as skynox7, proxyjacking network edge devices by installing Pawns.app residential proxy software. The actor compromised at least 143 devices in 34 countries using D-Link ShareCenter flaws CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324. Hikvision and Dahua DVR/NVR devices were also targeted, and some victims received attacker SSH keys for backup access. Residential proxy exits let malicious traffic appear to come from plausible user locations.

GreyNoiseupdated Oct 16, 09:02 UTC · 17h agofirst Oct 15, 00:00 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2024-3272 CVE-2024-3273 CVE-2021-44228

SAP security advisory – October 2026 monthly rollup (AV26-1030)

Canadian Cyber Centre urges patching after SAP's October 2026 rollup affects multiple products.

On October 13, 2026, the Canadian Centre for Cyber Security published advisory AV26-1030 for SAP's October 2026 Security Patch Day. Listed affected software includes SAP Cloud SDK before 0.45.2, SAP Commerce Cloud COM_CLOUD 2211-JDK21, SAP Manufacturing Integration and Intelligence 15.5 and XMII 15.4, NetWeaver Visual Composer VC70RUNTIME 7.50, multiple NetWeaver and Web Dispatcher kernel versions, and SAP S/4HANA S4CORE 105 through 109. The notice names no CVE identifiers and does not report exploitation. Administrators are urged to review SAP's patch-day guidance and apply available updates.

Canadian Centre for Cyber SecurityOct 13, 13:27 UTC · 3d agoAdvisory

SAP NetWeaver Visual Composer

Timeline5 articles

Related CVEsby mentions

Appears with

Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks

New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

skynox7: Proxyjacking Edge Devices Into Residential Proxies

SAP security advisory – October 2026 monthly rollup (AV26-1030)