Cybercriminals Exploit Tech Flaws to Hijack Devices

A recent cybercrime campaign has exploited security vulnerabilities in products from D-Link, Ubiquiti, and SAP, compromising at least 143 devices across 34 countries. The attackers have utilized these vulnerabilities to install Pawns.app proxy software, effectively turning the compromised devices into nodes for a residential proxy network.

This malicious activity allows operators to reroute internet traffic through the victims’ real IP addresses, obfuscating their activities and blending them with regular user traffic, making detection challenging. GreyNoise researchers have tracked this campaign and linked it to a cyber actor identified as ‘skynox7.’ The campaign utilized known flaws in network storage, video surveillance, and enterprise software to gain unauthorized access.

Exploited Vulnerabilities in Popular Technologies

GreyNoise identified four specific vulnerabilities across the affected technological products. The vulnerabilities include CVE-2024-3272 and CVE-2024-3273 in D-Link devices, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer. These flaws allowed attackers to install software that, while legitimate with user consent, becomes a tool for unauthorized proxyjacking.

Particularly, the D-Link vulnerabilities are tied to the company’s ShareCenter NAS devices, which are known for command-injection risks. For SAP, the threat comes from the Metadata Uploader component in NetWeaver Visual Composer, where attackers can upload executable files without authentication. Ubiquiti’s vulnerability is related to its UniFi Video NVRs, though specific device details remain undisclosed.

Implications of Proxyjacking

The use of residential proxies in this campaign highlights the growing risk of proxyjacking, where cybercriminals exploit devices without the owner’s knowledge to monetize internet connections. Unlike traditional proxy servers, residential proxies use IP addresses typical of home or business networks, complicating the detection of unauthorized activity.

GreyNoise warns that the installation of proxy software without consent poses significant security risks, as it allows the operator to persistently access compromised devices, even if the initial vulnerabilities are patched. The prolonged access is often maintained by setting up SSH key authentication.

Protective Measures for Organizations

Organizations are advised to identify and secure any internet-facing NAS devices, NVRs, and SAP systems, ensuring they are up-to-date with vendor patches or mitigations. In cases where immediate patching is not possible, access to vulnerable services should be restricted to prevent unnecessary exposure to the internet.

Security teams should diligently review authentication logs for signs of residential proxy usage, especially when multiple users appear to access the network from the same IP address. GreyNoise suggests examining additional signals such as device identifiers and session strings to verify login authenticity.

In conclusion, the ongoing threat of proxyjacking underscores the importance of maintaining robust cybersecurity defenses. Organizations must stay informed about potential vulnerabilities and swiftly implement recommended security measures to protect their networks from similar threats.