Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks

A cybercrime campaign has compromised at least 143 devices in 34 countries by exploiting flaws in D-Link, Ubiquiti and SAP products.

The attackers installed Pawns.app proxy software on victim devices, turning their internet connections into residential proxy nodes.

That lets the operator route internet traffic through the victims’ real IP addresses, which can make the activity harder to trace and may help it blend in with ordinary user traffic.

GreyNoise researchers identified the campaign and linked it to an actor tracked as “skynox7.” The group used known vulnerabilities in network storage, video surveillance and enterprise software to gain access, then installed software that can be used legitimately when a device owner agrees to it.

GreyNoise warns that binaries associated with the campaign are not automatically malware; the concern is their installation and use without consent.

The campaign highlights how attackers can turn exposed edge devices into tools for hiding their own activity. Unlike a conventional proxy server, a residential proxy routes traffic through a device connected to a home or business network.

Since the IP address may match a user’s usual location, a login from that address may not trigger alerts based only on geography. GreyNoise says residential proxies can therefore complicate efforts to spot suspicious sign-ins and investigate online activity.

Hackers Exploit D-Link, Ubiquiti and SAP Flaws

GreyNoise says the actor exploited four vulnerabilities across three product groups. The affected technologies were D-Link ShareCenter NAS devices, Ubiquiti UniFi Video network video recorders (NVRs), and SAP NetWeaver Visual Composer.

The reported flaws were CVE-2024-3272 and CVE-2024-3273 in D-Link devices, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer.

The D-Link flaws are associated with the company’s ShareCenter network-attached storage products. Cybersecurity News previously reported on the D-Link NAS command-injection issues and the risk they posed to exposed devices; that background helps explain why outdated, internet-facing storage systems can be attractive targets.

Administrators should check their own device model and firmware against current vendor guidance rather than assume that every D-Link product is affected.

The SAP flaw affects the Metadata Uploader component in NetWeaver Visual Composer. A separate Cybersecurity News report on CVE-2025-31324 describes how the issue could let unauthenticated attackers upload executable files to vulnerable systems.

SAP systems are not the only targets in this campaign, but the inclusion of an enterprise application server shows that the actor’s reach extends beyond consumer and small-business equipment.

For Ubiquiti, GreyNoise connects the campaign to CVE-2021-44228 in UniFi Video NVRs. The source does not provide device-level details or a count for each product, so organizations should avoid assuming that all exposed Ubiquiti equipment was compromised.

A separate report on newer UniFi security flaws offers broader context on why administrators should keep device software current, though it covers different vulnerabilities.

After gaining access, the actor installed Pawns.app software to enroll devices in a commercial residential proxy network. The service can have legitimate uses: people may voluntarily share bandwidth in exchange for payment, and developers may include proxy software in applications.

Proxyjacking is different. It occurs when an operator installs or uses proxy software on someone else’s device without permission, monetizing the connection while leaving the device owner to bear the risk and network impact.

GreyNoise also says that, in some cases, the attacker set up SSH key authentication as a backup way to access compromised devices. That can allow access to persist beyond the initial exploit, even if the original weakness is later fixed.

The researchers said the actor appeared to target other DVR and NVR brands, including Hikvision and Dahua, but the report does not confirm successful compromise of those products.

The consequences can extend beyond the affected device. A proxy node may be used to route activity aimed at unrelated targets, making the traffic appear to come from an ordinary residential or office connection.

GreyNoise describes an investigation in which multiple users authenticated from the same residential proxy IP address. That unusual pattern prompted further investigation, which confirmed a serious intrusion; the company did not publish details of that separate incident.

What defenders should check

Organizations should identify internet-facing NAS devices, NVRs and SAP systems, confirm whether the named products and vulnerable components are present, and apply vendor updates or mitigations.

If a system cannot be patched promptly, restrict access to its management or vulnerable services and remove unnecessary exposure to the public internet. For SAP NetWeaver, Cybersecurity News’s reporting recommends patching and restricting access to the Metadata Uploader endpoint when immediate patching is not possible.

Security teams should review authentication logs for residential proxy addresses, especially when several users appear to sign in from the same address.

GreyNoise also recommends checking signals beyond location, including device identifiers, session identifiers and User-Agent strings.

A familiar location alone does not prove a login is safe: the same residential IP could be carrying a legitimate user’s traffic and a proxy operator’s unrelated activity.

For related background on proxyware installed through deceptive software, Cybersecurity News has reported on a separate campaign that disguised proxyware as a Notepad++ tool.

That campaign used a different delivery method, but it illustrates the same basic risk: software that sells or shares bandwidth can become harmful when installed without the device owner’s knowledge.

Indicators of compromise (IoCs):-

Work flow (Source – GreyNoise)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.