New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
GreyNoise disclosed a proxyjacking campaign that compromised at least 143 devices in 34 countries by exploiting network and enterprise software flaws. The attacker used CVE-2024-3272 and CVE-2024-3273 on D-Link ShareCenter NAS devices, CVE-2021-44228 on Ubiquiti UniFi Video, and CVE-2025-31324 on SAP NetWeaver Visual Composer, then installed the legitimate Pawns.app bandwidth-sharing client without consent. Hikvision and Dahua recorders were also targeted, though the vulnerabilities used were not identified. In some cases SSH keys were added for backup access. GreyNoise says the activity monetizes victims' bandwidth as residential proxy infrastructure and is not attributed to a named operator.