New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
74
Vendor
Hikvision
- Mentions · 7d0
- Mentions · 30d6
- All mentions10
- First seenAug 17, 2026
- Last mentioned15d ago
Timeline
10 articles · newest firstHackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.
58
skynox7: Proxyjacking Edge Devices Into Residential Proxies
An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.
72
Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes
GreyNoise saw exploitation attempts against Ukrainian Hikvision cameras using CVE-2021-36260, with no confirmed strike link.
68
Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts
GreyNoise saw exploitation attempts against Hikvision CVE-2021-36260 aimed at Ukraine, without confirmed device takeovers.
67
Spike in Attacks Targeting Digital Video Recorders in Ukraine
GreyNoise recorded a nine-day surge of CVE-2021-36260 exploitation attempts against Hikvision devices in Ukraine.
62
US offering $10 million for info on Iranian hackers behind IOControl malware
US offers up to $10 million for information on CyberAv3ngers' 'Mr. Soul,' whose IOControl malware targets US and worldwide ICS/SCADA devices.
52
AI will not fix a governance problem in your camera estate
Hikvision EMEA security director argues camera estates need governance, recovery controls, and secure-by-default settings rather than AI fixes.
18
3 Vulnerabilities Found on AvertX IP Cameras
Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.
26
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
Related CVEs
by mentions- CVE-2021-36260100%9.8Unauthenticated Command Injection in Hikvision Device Web Server
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2024-327298%9.8Hard-Coded Backdoor Credentials in End-of-Life D-Link NAS Devices
- CVE-2025-3132499%9.8Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
- CVE-2024-3273100%9.8Command Injection in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS Devices
- CVE-2022-26134100%9.8Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
- CVE-2022-29464100%9.8Unrestricted file upload leading to unauthenticated RCE in multiple WSO2 products
- CVE-2024-1091498%9.2OS Command Injection in D-Link DNS-320/320LW/325/340L NAS Firmware
- CVE-2020-11623<1%6.8An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438
- CVE-2020-116251%5.3An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438
Appears with
- GreyNoiseorganization · 6
- D-Linkvendor · 5
- SAPvendor · 3
- PureVPNorganization · 3
- Dahuavendor · 3
- Pawns.appproduct · 3
- Ubiquitivendor · 3
- D-Link ShareCenterproduct · 3
- SAP NetWeaver Visual Composerproduct · 3
- Hikvision NVRsproduct · 2
- Hikvision IP camerasproduct · 2
- CISAorganization · 2
- IPRoyalorganization · 2
- Ubiquiti UniFi Videoproduct · 2
- Fortinetvendor · 1
- AC15product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.