Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
Actor skynox7 exploited D-Link, Ubiquiti, and SAP flaws to proxyjack 143 devices.
75
Vendor
D-Link
- Mentions · 7d0
- Mentions · 30d9
- All mentions17
- First seenAug 13, 2026
- Last mentioned15d ago
Timeline
17 articles · newest firstNew Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
74
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.
58
skynox7: Proxyjacking Edge Devices Into Residential Proxies
An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.
72
New Linux malware turns vulnerable IoT devices into proxy nodes
Fortinet says ClingSTUN Linux malware exploits known IoT flaws to turn devices into STUN-backed proxy nodes.
72
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.
76
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.
68
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.
76
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
FortiGuard Labs says ClingSTUN Linux backdoor abuses STUN and exploits dozens of device flaws to spread.
74
D-Link warns of max severity zero-day bug in DIR-822A routers
D-Link warns of an unpatched maximum-severity DHCP buffer overflow in legacy DIR-822A routers, with public proof-of-concept code.
73
US offering $10 million for info on Iranian hackers behind IOControl malware
US offers up to $10 million for information on CyberAv3ngers' 'Mr. Soul,' whose IOControl malware targets US and worldwide ICS/SCADA devices.
52
New Mirai Variant Targeting Network Security Devices
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
75
Mirai Variant MooBot Targeting D
Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.
40
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
42
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
[remote] D-Link DNS_340L - OS Command Injection
An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.
21
New Mirai variant adds stealth capabilities to notorious botnet code
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
60
Related CVEs
by mentions- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2025-3132499%9.8Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
- CVE-2024-3273100%9.8Command Injection in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS Devices
- CVE-2024-327298%9.8Hard-Coded Backdoor Credentials in End-of-Life D-Link NAS Devices
- CVE-2023-1389100%8.8Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution
- CVE-2022-30525100%9.8OS Command Injection in Zyxel Firewalls Enables Remote Command Execution
- CVE-2025-3403525%10.0Unauthenticated root command injection in EnGenius EnShare
- CVE-2021-4642294%9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication
- CVE-2024-2362523%9.8A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages
- CVE-2022-3655391%9.8Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi
Appears with
- TP-Linkvendor · 6
- Miraimalware · 5
- Hikvisionvendor · 5
- FortiGuard Labsorganization · 5
- ClingSTUNmalware · 5
- Hytecvendor · 5
- EnGeniusvendor · 4
- Fortinetvendor · 4
- D-Link ShareCenterproduct · 4
- SAP NetWeaver Visual Composerproduct · 4
- Ubiquitivendor · 4
- SAPvendor · 4
- GreyNoiseorganization · 4
- Tendavendor · 4
- Realtekvendor · 4
- Avtechvendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.