New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
GreyNoise disclosed a proxyjacking campaign that compromised at least 143 devices in 34 countries by exploiting network and enterprise software flaws. The attacker used CVE-2024-3272 and CVE-2024-3273 on D-Link ShareCenter NAS devices, CVE-2021-44228 on Ubiquiti UniFi Video, and CVE-2025-31324 on SAP NetWeaver Visual Composer, then installed the legitimate Pawns.app bandwidth-sharing client without consent. Hikvision and Dahua recorders were also targeted, though the vulnerabilities used were not identified. In some cases SSH keys were added for backup access. GreyNoise says the activity monetizes victims' bandwidth as residential proxy infrastructure and is not attributed to a named operator.
- GreyNoise reports at least 143 devices compromised across 34 countries.
- Exploited flaws include D-Link NAS bugs, Log4Shell on UniFi Video, and SAP NetWeaver CVE-2025-31324.
- Hikvision and Dahua recorders were targeted, but the specific flaws were not identified.
- Attackers installed Pawns.app and sometimes added SSH keys for backup access.
- Residential proxy exits can hide malicious sign-ins behind ordinary-looking IP addresses.
Vulnerabilities mentionedAll →
- CVE-2021-4422810.0100%JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)published · Apache Log4j2 KEV ransomware PoC ×9
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | pawns.app | et connections. GreyNoise identified an attacker installing Pawns.app, a legitimate bandwidth-sharing application, without device |
| sha256 | 26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e | 2a4f904564593e2ed69f87cbb7bbd6c206a874ecf7 SHA256 PAWNS APP 26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e SHA256 PAWNS APP df27938d26c1c9421ff307aafcb87131521e05f5d8 |
| sha256 | 4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7 | d3ce0f17d3479bc246bc6c163eb90b1a84adb453a7 SHA256 PAWNS APP 4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7 SHA256 PAWNS APP 26abd52f207739556282023e82873424795abc5e52 |
| sha256 | df27938d26c1c9421ff307aafcb87131521e05f5d87ecaaab4a32ece3335fee4 | 3e82873424795abc5e527771205a40749f90c01f6e SHA256 PAWNS APP df27938d26c1c9421ff307aafcb87131521e05f5d87ecaaab4a32ece3335fee4 SHA256 PAWNS APP Note: IP addresses and domains are intenti |
| sha256 | e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd | e generated the observed traffic. IOCs IOC Type Description e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd SHA256 PAWNS APP fdc18f4287c1c6a285c664d3ce0f17d3479bc246bc |
Full article624 words · extracted from gbhackers.com · click to collapse
A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting vulnerabilities in network appliances and enterprise software to monetize victims’ internet connections.
GreyNoise identified an attacker installing Pawns.app, a legitimate bandwidth-sharing application, without device owners’ consent, turning compromised systems into commercial residential proxy nodes.
Unlike conventional VPN or hosting infrastructure, residential exit addresses can resemble legitimate users’ connections, weakening defenses that depend heavily on IP reputation or geographic anomalies.
According to GreyNoise’s investigation, the attacker exploited CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 in Ubiquiti UniFi Video NVR systems, and CVE-2025-31324 in SAP NetWeaver Visual Composer.
These compromises provided access for deploying the proxyware on victims’ infrastructure.
Researchers also observed targeting of Hikvision and Dahua digital and network video recorders, although the disclosed findings did not identify the vulnerabilities used against those products.
In some compromises, the attacker configured SSH key authentication as a backup access mechanism, creating another route into affected devices beyond the installed proxy application.
GreyNoise Researchers said that, the operation shows how attackers can generate revenue while expanding infrastructure that hides malicious traffic behind ordinary internet connections.
Proxyjacking Campaign
Pawns.app’s command-line variants accept account credentials and device information at runtime, allowing an installer to associate another device’s bandwidth with an operator-controlled account.
IPRoyal identifies Pawns.app as a direct residential-proxy sourcing partner. The abuse concerns unauthorized deployment of legitimate software, rather than evidence that either provider directed the campaign.
The research followed a separate incident uncovered during a live GreyNoise product demonstration.
An organization discovered IP addresses labeled malicious in its Microsoft Entra ID sign-in logs, even though those addresses appeared residential and geographically consistent with expected user activity.
Initial investigation established that the addresses belonged to residential proxy networks, but that finding alone could not establish whether the organization was compromised.
A legitimate user can share an outward-facing IP address with unrelated malicious traffic when a device behind that connection participates in a proxy network.
The stronger signal emerged when investigators found multiple users authenticating through the same residential address. Further investigation confirmed a serious intrusion.
GreyNoise withheld incident details, and the disclosed evidence does not establish that the intrusion and the subsequently identified proxyjacking operation shared an operator.
The broader technique has established precedents. In its Midnight Blizzard investigation, Microsoft documented attackers using distributed residential proxies to disguise password-spraying and subsequent access.
Rapidly changing addresses made traditional infrastructure-based indicators insufficient for reliable detection.
Separately, Sysdig documented Log4j-enabled proxyjacking in 2023, showing attackers installing proxyware instead of cryptocurrency miners.
That distinction matters operationally: monetizing network bandwidth can produce less conspicuous CPU activity than mining, allowing unauthorized software to escape resource-focused monitoring.
These historical findings provide context, not attribution for GreyNoise’s campaign.
Defenders should correlate suspicious sign-ins with identity behavior and device context rather than treating plausible geography as proof of legitimacy.
Microsoft recommends investigating unfamiliar authentication properties and password-spray activity.
GreyNoise also offers a free IP-checking service, requiring an account, to identify whether an address has interacted with its observation network; a match warrants investigation but does not independently prove proxyjacking or identify which device generated the observed traffic.
IOCs
| IOC | Type | Description |
|---|---|---|
e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd | SHA256 | PAWNS APP |
fdc18f4287c1c6a285c664d3ce0f17d3479bc246bc6c163eb90b1a84adb453a7 | SHA256 | PAWNS APP |
4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7 | SHA256 | PAWNS APP |
26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e | SHA256 | PAWNS APP |
df27938d26c1c9421ff307aafcb87131521e05f5d87ecaaab4a32ece3335fee4 | SHA256 | PAWNS APP |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Mayura Kathirhttps://gbhackers.com/
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.