Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

Threat actors exploited multiple known vulnerabilities—CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer—to breach edge devices and install Pawns.app, a legitimate bandwidth-sharing application, without consent. This software enables the attackers to resell stolen bandwidth by routing traffic through compromised devices as part of a commercial residential proxy network. Additional targeting of Hikvision and Dahua DVR/NVR devices was observed, though specific vulnerabilities were not disclosed. Attackers also set up SSH key authentication for backup access. The campaign was discovered by GreyNoise during investigation of suspicious activity and affects devices across 34 countries.

Compromised devices are used to route proxy traffic, allowing attackers to monetize stolen bandwidth. This can lead to degraded network performance for victims and potential reputational damage if the IP addresses are associated with malicious or suspicious activities. Victims may face IP blocks or be implicated in illegal activities due to the proxy traffic. The unauthorized installation of software and persistent access via SSH keys increases the risk of further exploitation.

Users should ensure all affected devices are updated with the latest security patches addressing the referenced CVEs. Strong credentials and secure configurations should be enforced, and network access should be restricted to trusted sources. Avoid installing software from untrusted sources to prevent unauthorized enrollment in proxy networks. Since the vulnerabilities exploited are known, applying vendor patches and following vendor advisories is critical. Monitoring for unauthorized SSH keys and removing them can help prevent persistent access.