Cybercriminals Hijack D-Link, Ubiquiti, and SAP Devices for Proxy Networks
A cybercrime campaign has compromised over 140 devices across 34 countries by exploiting vulnerabilities in D-Link, Ubiquiti, and SAP products to install proxy software.
A sophisticated cybercrime campaign, attributed by GreyNoise researchers to an actor known as "skynox7," has successfully compromised at least 143 devices in 34 countries. The attackers leveraged known vulnerabilities in products from D-Link, Ubiquiti, and SAP to gain unauthorized access. Once inside, they installed Pawns.app, a legitimate proxy software, without the device owners' consent. This action effectively transformed the compromised devices into residential proxy nodes, routing the attackers' internet traffic through the victims' IP addresses.
The primary goal of this proxyjacking operation is to obscure the attackers' own malicious activities. By routing traffic through legitimate residential IP addresses, threat actors can make their online actions significantly harder to trace and potentially blend in with normal user traffic, evading detection by security systems and law enforcement. GreyNoise emphasizes that while Pawns.app itself is not inherently malicious, its installation and use without consent constitute a security risk and a form of abuse.
The campaign targeted a range of devices, including D-Link ShareCenter NAS devices, Ubiquiti UniFi Video network video recorders (NVRs), and SAP NetWeaver Visual Composer. Specifically, the exploited vulnerabilities include CVE-2024-3272 and CVE-2024-3273 affecting D-Link devices, CVE-2021-44228 (Log4Shell) impacting Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer. The inclusion of an enterprise application server like SAP indicates the actor's broad reach beyond consumer-grade or small business equipment.
Residential proxies offer a distinct advantage to attackers compared to traditional proxy servers. They route traffic through devices connected to actual home or business networks, meaning the originating IP address often matches a user's typical location. This can bypass security alerts that might otherwise be triggered by logins from unusual geographic regions, complicating efforts to spot suspicious activity and conduct investigations.
In addition to installing the proxy software, the attackers also implemented SSH key authentication on some compromised devices. This measure serves as a backup access method, allowing the threat actor to maintain persistence even if the initial vulnerability used for exploitation is later patched. While the report mentions potential targeting of other NVR brands like Hikvision and Dahua, successful compromise of these specific products was not confirmed.
The consequences of such proxyjacking extend beyond the individual device. A compromised node can be used to route traffic for activities targeting unrelated systems, making the malicious activity appear to originate from an ordinary residential or office connection. GreyNoise researchers noted an incident where multiple users authenticated from the same residential proxy IP address, a pattern that led to further investigation and confirmation of a significant intrusion.
To mitigate these risks, organizations are advised to identify and secure internet-facing NAS devices, NVRs, and SAP systems. This includes confirming the presence of affected products and components, and promptly applying vendor-provided updates or mitigations. If immediate patching is not feasible, restricting access to management interfaces and vulnerable services, and minimizing exposure to the public internet are crucial steps.
Security teams should also enhance their monitoring of authentication logs, paying close attention to unusual patterns such as multiple users logging in from the same residential proxy IP address. Beyond location-based alerts, it is recommended to examine other indicators like device identifiers, session identifiers, and User-Agent strings to detect potentially compromised systems. The campaign serves as a stark reminder of how exposed edge devices can be repurposed for illicit activities, underscoring the importance of diligent security hygiene and timely patching.