Key points
- GreyNoise identified 143 compromised devices in a campaign spanning 34 countries.
- Attackers installed legitimate Pawns.app software without owner consent to monetize bandwidth.
- Exploited vulnerabilities include CVE-2024-3272, CVE-2024-3273, CVE-2025-31324, and CVE-2021-44228.
A proxyjacking campaign has compromised at least 143 devices across 34 countries, according to threat intelligence firm GreyNoise. The operator installed Pawns.app, a legitimate bandwidth-sharing application, on network equipment without the owners' knowledge. This unauthorized installation turns victim devices into residential proxy nodes, allowing the attacker to route internet traffic through their connections for financial gain.
By the numbers
- 143 compromised devices identified worldwide in the campaign.
- 34 countries affected by the unauthorized installation of proxy software.
- Four specific CVEs exploited across D-Link, SAP, and Ubiquiti products.
What the figures mean
The widespread geographic footprint indicates a systematic scanning operation targeting exposed edge devices. By using a legitimate application, the attacker avoids triggering traditional malware alerts, complicating detection efforts. The use of real residential IP addresses makes the routed traffic appear as normal user activity, potentially evading geographic-based security rules and obscuring the true source of malicious requests.
What should you do?
Managed service providers should immediately audit internet-facing network-attached storage and video surveillance systems for unauthorized software installations. Teams must verify that all devices are running the latest firmware versions to close known vulnerabilities. Administrators should review access logs for unusual SSH key configurations or unexpected outbound connections that could indicate proxy traffic.
Operational impact
Organizations should ask whether their asset inventory includes all internet-facing devices and if monitoring covers bandwidth usage anomalies. Security teams need to determine if current logging captures application-level installations, not just network traffic. Management should be informed about the risk of IP reputation damage if devices are used for credential stuffing or other illicit activities.
Background: Credential stuffing
Credential stuffing uses automated tools to test stolen username and password pairs against your login portals. Small businesses are prime targets because they often lack advanced detection. Protect yourself by enforcing multi-factor authentication, blocking known malicious IP addresses, and implementing conditional access policies that verify user context before granting entry.
Read the full guide: Credential Stuffing Risks and Protection for Small Businesses
What to do and how to stay safe: D-Link
- Check vendor advisories for patches addressing CVE-2024-3272, CVE-2024-3273, CVE-2025-31324, and CVE-2021-44228.
- Scan network traffic for connections to known proxy services or unusual data exfiltration patterns.
- Verify that strong authentication methods are enforced on all remote management interfaces.
- Monitor for unexpected process executions on NAS and NVR devices that do not match standard operations.
Step-by-step guide: Fix Incident Response Plans That Fail Under Pressure
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific vulnerabilities were exploited in this campaign?
Attackers used CVE-2024-3272 and CVE-2024-3273 in D-Link NAS, CVE-2025-31324 in SAP NetWeaver, and CVE-2021-44228 in Ubiquiti NVRs.
Is Pawns.app considered malware?
No, it is a legitimate application, but its installation without consent is unauthorized and used here for proxyjacking.
How many countries were affected by this attack?
The campaign impacted devices in 34 countries, according to GreyNoise research.
