Attackers hijack network gear to resell bandwidth via proxy service

Threat actors are hijacking internet-connected devices to resell stolen bandwidth through a commercial residential proxy network. According to BleepingComputer, the campaign impacts systems in 34 countries by installing Pawns.app, a legitimate application that rewards users for sharing their internet connections. The operator forces these devices to act as proxy nodes, allowing traffic from other users to flow through the victims' networks without their knowledge or consent.

How it unfolded

• GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organisation.
• Researchers identified at least 143 compromised devices worldwide participating in the scheme.
• Attackers leveraged specific vulnerabilities to breach edge devices and install the software.

Who is affected

The campaign targets a range of enterprise and consumer hardware. According to the report, attackers exploited CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices. They also used CVE-2025-31324 in SAP NetWeaver Visual Composer to gain access. Additionally, researchers observed targeting of Hikvision and Dahua DVR and NVR devices, though the specific vulnerabilities used for those systems were not specified. In some cases, the attackers configured SSH key authentication as a backup method to maintain access.

The fix

No confirmed patch or removal guide for this specific campaign has been provided in the source material. GreyNoise offers a free service, requiring an account, for users to check if their IP address is part of a known proxying service. Generally, keeping NAS devices, video recorders and other internet-facing systems updated reduces the risk of compromise. Users should also employ strong credentials and restrict network access to secure configurations.

What analysts watch for

Teams usually examine outbound traffic for unexpected connections to residential proxy networks. Analysts check whether legitimate bandwidth-sharing applications are running on servers or network appliances where they do not belong. They inspect system processes for unauthorized software installations and review access logs for new SSH keys or unusual authentication methods. Monitoring for changes in network configuration files helps identify persistence mechanisms. Teams also verify that all internet-facing devices are patched against known vulnerabilities to prevent initial compromise.

Background: Threat actors

A threat actor is any individual or group that intentionally seeks to compromise information systems. They may be motivated by money, ideology, or espionage. Understanding their methods helps you defend against specific techniques rather than abstract fears.

Read the full guide: Threat Actors Definition: Who They Are and How They Operate

What to do and how to stay safe: D-Link

• Check your IP address using GreyNoise’s service to see if it is listed as a proxy node.
• Review installed applications on network devices for unauthorised software like Pawns.app.
• Update D-Link, SAP, Hikvision and Dahua devices to patch known vulnerabilities.
• Enforce strong credentials and restrict remote access on all internet-facing systems.

Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What devices are targeted in this campaign?

The campaign targets D-Link ShareCenter NAS, SAP NetWeaver, Hikvision and Dahua devices.

How do attackers monetise the compromised devices?

They install Pawns.app to resell the victims' bandwidth through a commercial proxy network.

Which vulnerabilities are exploited?

Attackers use CVE-2024-3272, CVE-2024-3273 and CVE-2025-31324 for access.