Attackers turn 143 D-Link NAS and Ubiquiti NVRs into residential proxy nodes
On October 15, 2026, GreyNoise documents a proxyjacking campaign that installs Pawns.app, a legitimate bandwidth-sharing app, on compromised D-Link NAS and Ubiquiti NVR devices across 34 countries. Check whether your edge devices are exposed and whether your IP address already belongs to a residential proxy network.
October 15, 2026. Threat intelligence firm GreyNoise publishes its analysis of a proxyjacking campaign that monetized the internet connections of 143 devices across 34 countries. October 14, 2026. The researchers spot the activity while investigating suspicious traffic at an unnamed customer. October 2026. The operator abuses known flaws — including Log4Shell — to install Pawns.app on edge devices. Why it matters: the attacker steals no data and encrypts nothing. It quietly siphons your bandwidth for resale, and your IP address ends up in a residential proxy pool that other criminals will use.
The mechanics: monetizing a stolen connection without being noticed
Proxyjacking is the quiet cousin of cryptojacking. Instead of burning the victim’s CPU to mine coins, the attacker installs a connection-sharing client and collects the revenue generated by the traffic flowing through it. Here, the dropped app is Pawns.app, a perfectly legitimate service that pays users to let traffic pass through their network — provided the IP address is “trusted” and absent from blocklists.
The hijack is brutally effective. Pawns.app is signed, documented, and available on official app stores. Once installed on several systems without their owners’ consent, it accrues payouts to the attacker’s account. The legitimate owner sees nothing: no noticeable slowdown, no suspicious window, no ransom note. Just one more residential IP in a commercial pool.
That is the real danger. Residential proxies are the currency of online crime. The FBI has already warned that these networks are used for large-scale credential stuffing against online platforms: traffic that appears to originate from real households, spread across thousands of addresses, bypasses anti-fraud defenses far more easily than traffic emitted from a datacenter.
The exploited flaws: an inventory of what is still unpatched
GreyNoise lists the vulnerabilities used to break into the edge devices. None are recent, and that is the point.
- CVE-2024-3272 and CVE-2024-3273 affect D-Link ShareCenter NAS devices — two pre-authentication command injection flaws, rated CVSS 9.8, which abused a hardcoded service account (
messagebus, empty password) on the DNS-320L and DNS-325 boxes. Disclosed in early April 2024, they remain alive on devices that were never updated. - CVE-2021-44228, the infamous Log4Shell, is exploited against the Ubiquiti UniFi Video NVR. A 2021 flaw, fixed years ago, still alive on video recorders forgotten in a closet.
- CVE-2025-31324 affects SAP NetWeaver Visual Composer, proof that the campaign casts a wide net beyond consumer networking gear.
The researchers also observed targeting of Hikvision and Dahua DVR/NVR recorders, without specifying the flaws used. The common thread across this whole surface: internet-connected devices, rarely patched, often shipped with default credentials.
The attacker does not stop at installation. In some cases GreyNoise found that SSH keys were configured as a backup access method. That is the mark of an operator planning to stay, and preparing a discreet return after any cleanup.
Why this campaign goes unnoticed
Proxyjacking is harder to spot than its cousins. Cryptojacking heats up the CPU and inflates the power bill; ransomware encrypts files and announces itself. Here, none of that happens. Pawns.app consumes few resources, produces no message, and the outbound traffic it generates is almost indistinguishable from ordinary home browsing.
That is, in fact, how the campaign was discovered. GreyNoise was chasing anomalous traffic inside an organization, not acting on a victim report. The enrolled devices had no reason to alert their owners: a signed app, a well-known online service, payouts landing in the attacker’s account. The only tangible clue is an IP address that starts appearing in proxy pools — and you have to know where to look.
The SSH keys configured as a backup path compound the stealth. Even if an administrator notices the Pawns.app process and removes it, the attacker keeps a way back in, ready to reinstall the payload on the next pass. The lesson holds for every silent form of edge-device monetization: what you do not actively hunt for, you will not find.
Why your IP address is the real prize
This campaign’s payload is not exotic malware. It is your residential IP address, turned into a commodity. The business model of Pawns.app and its competitors rests on the trust platforms place in domestic connections: a request coming from a residential IP is presumed legitimate.
Once a device is enrolled, its address can carry credential stuffing operations, e-commerce scraping, ad fraud, or geo-bypassing. The owner, meanwhile, carries the apparent responsibility: their IP can be blocked by services they use, or flagged for activity they never initiated.
The economics favour the attacker. A single residential IP enrolled in a proxy network rents at a premium precisely because it is residential — the address type anti-fraud systems trust most. Multiply that across 143 confirmed devices, plus an unknown number of Hikvision and Dahua recorders, and the operator runs a quiet, recurring-revenue business on hardware that belongs to someone else. The victim pays twice: the bandwidth is stolen, and the IP’s reputation is burned for anything legitimate the owner still wants to do online.
GreyNoise offers a free service — account required — to check whether an IP address already appears in a known legitimate or “gray” proxy network. That is the first reflex to have, before even hunting for a patch.
What to do, in order
The remedy is unglamorous but precise. The campaign is not hunting sophisticated enterprise infrastructure: it harvests the edge boxes nobody looks at.
# 1. Inventory of internet-exposed devices (NAS, NVR/DVR, cameras)
# — confirm only necessary services are published.
# 2. Detect a suspicious listener on the box (added SSH keys):
cat ~/.ssh/authorized_keys # on the NAS/NVR, look for unknown keys
# 3. Check your public IP against GreyNoise's free service:
curl https://api.greynoise.io/v3/community/<PUBLIC_IP>Priority goes to devices that combine two defects: exposed to the internet and unpatched. A D-Link ShareCenter NAS or a Ubiquiti UniFi Video NVR plugged straight into the router without a fix is a designated target. Update them, pull them out of public exposure where possible, and segment them behind a dedicated IoT VLAN.
Add a lightweight egress check too. A NAS or video recorder that starts dialing out to proxy or bandwidth-sharing endpoints — rather than waiting to be polled — is precisely the footprint this campaign leaves behind, and it is visible to any firewall that logs outbound connections.
For organizations, the lesson goes beyond Pawns.app. Any edge device that is neither inventoried nor patched is an asset someone will eventually monetize on your behalf — whether by mining, proxying, or encrypting. Proxyjacking is simply the quietest variant of the three.
Verdict
If you run exposed NAS devices or video recorders, treat this campaign as a wake-up call: patch CVE-2024-3272/3273 and Log4Shell without waiting, since these are the documented entry points of the operation, and check your IP with GreyNoise. If your devices are up to date and behind a NAT with no port forwarding, the direct risk is low — but add the residential proxy question to your threat model: a stolen corporate IP can power attacks for which you will appear responsible. Either way, the order is the same: inventory, patch, segment, verify the IP.