Hackers turned old D-Link and Ubiquiti devices into paid internet proxies

The attacker went after edge devices: the boxes that sit at the edge of a network and talk to the internet directly. Think network storage, video recorders and servers.

Once inside, the attacker installed Pawns.app. That is a real, legitimate app that pays people for letting others route traffic through their internet connection. Here, nobody asked the owners.

• Devices compromised: at least 143.
• Countries: 34.
• Software installed: Pawns.app, under the attacker's account.
• Backup access: in some cases, the attacker set up SSH key login so they could get back in later.

BleepingComputer, which reported the campaign, notes that installing the app on many systems likely meant larger payouts for the attacker.

A proxy is a middleman for internet traffic. A website sees the proxy's address, not yours.

Residential proxies use home internet connections as that middleman. Some people join these networks on purpose. GreyNoise quotes Intel 471, which sums up the pitch as "earn on your internet." You install a small program called proxyware, and strangers can browse through your connection while you collect passive income.

Proxyjacking is the same thing without permission. GreyNoise defines it as forcing victim devices into proxy networks to make money from their bandwidth. While sharing your own connection is a voluntary deal, GreyNoise is clear that doing it with someone else's device is a crime.

In real life It's like someone copying your house key, then renting your driveway out as a parking spot. You still own the house. Someone else is cashing the checks, and the cars parked there carry your address.

Through doors that were already known to be open. GreyNoise lists the flaws the attacker used:

GreyNoise also saw the attacker going after video recorders from Hikvision and Dahua. It did not say which flaws were used against those.

The big picture: none of these are brand new. CVE-2021-44228 is Log4Shell, the famous bug in a widely used logging library from 2021. The D-Link flaws were made public in April 2024.

Because many of them can never be fixed. When the D-Link NAS flaw became public in 2024, Help Net Security reported that it affected four old models: the DNS-320L, DNS-325, DNS-327L and DNS-340L.

• The flaw: a hidden account with the username "messagebus" and no password, plus a way to run commands on the device.
• Exposure in 2024: the researcher who found it counted more than 92,000 of these devices reachable on the internet.
• Patches: none. D-Link said the models had reached end of life and would get no more updates, and recommended retiring and replacing them.

The catch: a storage box that still works feels like it's fine. But "still works" and "still safe" stopped being the same thing years ago.

No, and GreyNoise is careful about that. It says the binaries it found "are not necessarily malware unless installed without consent."

According to GreyNoise, Pawns.app is a "direct partner" of the proxy company IPRoyal and supplies it with proxy nodes. IPRoyal then sells access for many legitimate uses. GreyNoise says Pawns.app appears to be a rebrand of "IPRoyal Pawns" and is owned by the same people.

There is a second way devices end up in these networks. GreyNoise says some commercial proxy companies offer software development kits (SDKs) that app makers can build into their apps. In that model, the app maker earns money by selling the bandwidth of the people who installed the app.

Here's the detail that made this campaign easy. Pawns.app offers ready-made versions of its software, and the command-line versions accept a username, password and device details at install time. GreyNoise says those features make it easy to install the app on a device the installer doesn't own, "which is exactly what GreyNoise recently observed."

It started with a sales demo. GreyNoise was showing its product to an organization, which found GreyNoise-flagged IP addresses in its Entra ID sign-in logs (Microsoft's login system for businesses).

The addresses looked residential and sat in the right part of the world for that company's users. At first, that seemed harmless.

GreyNoise points out a tricky detail: a perfectly legitimate login can come from an IP address that is, at the same moment, relaying an unrelated attacker's traffic somewhere else. So a flagged address alone proved nothing. Then the organization noticed something stranger: several different users were signing in from the same home IP address.

GreyNoise says that is very unlikely to happen legitimately. The organization dug deeper and confirmed a serious intrusion. GreyNoise won't publish details of that case, but it led to the research that uncovered this proxyjacking campaign.

Because home traffic looks innocent. Many security tools flag logins from data centers or VPN services. A home IP address in the right city sails past checks like "login from an impossible travel location." GreyNoise says hostile foreign intelligence services keep using residential proxies for exactly that reason.

Why it matters: the FBI has warned about exactly this. In a notice reported by Infosecurity Magazine, the bureau said criminals "have relied extensively on the use of residential proxies" for credential stuffing: trying leaked username and password pairs across many sites at once. The FBI added that security tools don't block residential proxies as often as data center ones.

BleepingComputer adds another risk for the people whose devices are used. Suspicious traffic flowing through your connection can get your IP address blocked, or make it look like you were involved in something you never did.

GreyNoise says it will keep giving government and law enforcement agencies the details they need to "disrupt, investigate, and bring perpetrators to justice."

It also offers a free check for anyone. With a free GreyNoise account, you can see whether your IP address has interacted with its global sensor network, which can be a sign of proxyjacking.

For companies, GreyNoise recommends:

• Teach users: explain the risks of free apps and the importance of patching personal devices.
• Watch sign-in logs: flag residential proxy IP addresses, especially when several employees log in from the same one.
• Look past location: check for mismatched device identifiers, session identifiers or User-Agent strings.

For more on how attackers are getting in these days, browse our cybersecurity coverage.

• Unplug what you don't use: an old NAS, camera recorder or router that faces the internet is a door. If it no longer gets updates, retire it.
• Keep the rest updated: BleepingComputer notes that patching NAS boxes, video recorders and other internet-facing devices greatly reduces the risk.
• Close remote access: don't expose device admin pages to the internet, and use strong, unique passwords.
• Be picky about free software: BleepingComputer warns that some "free" apps quietly enroll devices into residential proxy networks.