Full Report
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
Analysis Summary
# Incident Report: Global Proxyjacking Campaign Targeting Edge Devices
## Executive Summary
A widespread proxyjacking campaign has compromised edge devices across 34 countries to monetize victims' internet bandwidth via the legitimate "Pawns.app" residential proxy network. Attackers exploited known vulnerabilities in D-Link, Ubiquiti, and SAP systems to install unauthorized proxy software, potentially exposing owners to IP blacklisting and legal risks. Security researchers at GreyNoise identified the campaign and tracked at least 143 compromised devices globally.
## Incident Details
- **Discovery Date:** October 2026 (Reported)
- **Incident Date:** Ongoing through October 2026
- **Affected Organization:** Unnamed organization (initial discovery) and various global users
- **Sector:** Multi-sector (IoT, Home/SOHO, and Enterprise Edge)
- **Geography:** Global (34 countries impacted)
## Timeline of Events
### Initial Access
- **Date/Time:** Variable; campaign active as of late 2026.
- **Vector:** Exploitation of known vulnerabilities in internet-facing edge devices.
- **Details:** Attackers targeted D-Link NAS units, Ubiquiti NVRs, and SAP NetWeaver instances using public exploits.
### Lateral Movement
- **Details:** The report primarily focuses on external exploitation of edge devices; however, the establishment of SSH keys suggests a focus on maintaining persistent remote access to the compromised nodes rather than internal pivoting.
### Data Exfiltration/Impact
- **Impact:** Unauthorized consumption of network bandwidth; monetization of victim resources by the attacker. Victims face potential IP reputation damage and legal liability for traffic routed through their hardware.
### Detection & Response
- **Detection:** GreyNoise identified suspicious activity while investigating an unnamed organization’s network.
- **Response Actions:** Public disclosure of Indicators of Compromise (IoCs); GreyNoise released a lookup tool for users to check if their IPs are enrolled in proxy networks.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2024-3272/3273 (D-Link), CVE-2021-44228 (Ubiquiti), and CVE-2025-31324 (SAP NetWeaver).
- **Persistence:** Configuration of SSH key authentication as a "backup" access method.
- **Defense Evasion:** Use of legitimate bandwidth-sharing software (Pawns.app) to blend in with legitimate traffic.
- **Discovery:** Automated scanning for vulnerable Hikvision, Dahua, and D-Link devices.
- **Impact:** Resource Hijacking (Proxyjacking) for financial gain.
## Impact Assessment
- **Financial:** Direct financial gain for the attacker via Pawns.app payouts; potential data overage costs for victims.
- **Data Breach:** No direct data theft reported; however, unauthorized SSH access provides a gateway for future breaches.
- **Operational:** Degradation of network performance and potential blocking of the victim's IP by web services.
- **Reputational:** Victim IPs may be flagged for participating in illegal activities (e.g., credential stuffing) performed by proxy customers.
## Indicators of Compromise
- **Network Indicators:**
- Traffic associated with `pawns[.]app`
- Unauthorized SSH connections from unknown external IPs.
- **File Indicators:**
- Presence of `Pawns.app` binary or related execution artifacts on non-user devices (NAS/NVR).
- **Behavioral Indicators:**
- Unexpected outbound traffic spikes.
- Modification of `~/.ssh/authorized_keys` with unrecognized entries.
## Response Actions
- **Containment:** Disconnection of affected IoT/Edge devices from the internet.
- **Eradication:** Removal of unauthorized SSH keys and deletion of the Pawns.app software.
- **Recovery:** Firmware updates to patch exploited vulnerabilities; resetting all administrative credentials.
## Lessons Learned
- **Key Takeaways:** Attackers are increasingly moving from traditional cryptojacking to proxyjacking as a quieter way to monetize compromised IoT devices.
- **Gap Analysis:** Failure to patch long-known vulnerabilities (like Log4j in Ubiquiti or D-Link flaws) remains the primary driver for successful mass exploitation.
## Recommendations
- **Patch Management:** Immediately apply security updates for D-Link ShareCenter, Ubiquiti UniFi, and SAP NetWeaver.
- **Access Control:** Disable SSH on edge devices unless strictly necessary; utilize IP whitelisting for management interfaces.
- **Monitoring:** Monitor for unusual outbound traffic patterns and verify IP addresses against proxy service databases (e.g., GreyNoise).
- **Hardening:** Disable UPnP and move management interfaces behind a VPN rather than exposing them directly to the WAN.