GreyNoise identified at least 143 compromised devices across 34 countries tied to a proxyjacking campaign that covertly resold victims’ internet bandwidth.
GreyNoise investigation and scope
Threat intelligence firm GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization and attributed at least 143 compromised devices worldwide to the operation. The operator installed Pawns.app — a legitimate bandwidth-sharing application — on those devices without owners’ consent, turning otherwise private internet connections into nodes for a commercial residential proxy network.
Vulnerabilities the attackers exploited
According to GreyNoise, the attacker used multiple, specific software flaws to breach edge devices and install Pawns.app. The vulnerabilities named in the research include CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer. The researchers also observed targeting of Hikvision and Dahua DVR/NVR devices, though GreyNoise did not specify which vulnerabilities were exploited in those systems.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow Pawns.app was repurposed to monetize stolen bandwidth
Pawns.app is a legitimate application that pays account holders for allowing other users’ traffic to flow through their internet connections, provided the traffic appears on trusted, non-blocking IP addresses. In this campaign, an attacker installed Pawns.app on compromised devices without owner authorization. By enrolling multiple systems under a single operator-controlled account, the attacker likely increased the monetary payout from the commercial residential proxy service — effectively reselling stolen bandwidth for profit.
GreyNoise also observed cases where the attackers configured SSH key authentication as a backup access method after initial compromise, suggesting an intent to maintain persistent control over infected systems.
Risks to device owners: blocked IPs and wrongful attribution
Even when a proxy network is run using volunteer-operated nodes, insufficient oversight can permit suspicious or abusive traffic to transit through those nodes. GreyNoise warns that this may result in participating users’ IP addresses being blocked by online platforms or exposing them to allegations of involvement in illegal activity. The FBI has previously warned that such networks can be abused to carry out large-scale credential stuffing attacks against online platforms — a specific risk identified in GreyNoise’s analysis of proxying services.
What this means for technologists, enterprises, and end users
- Technologists and security teams: prioritize patching and configuration management for internet-facing systems cited in the report — notably D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs, SAP NetWeaver Visual Composer instances, and DVR/NVRs from Hikvision and Dahua — and look for signs of unauthorized installations such as Pawns.app or newly added SSH keys.
- Affected enterprises and procurement leaders: review exposure of NAS, video recorders, and other edge devices to the public internet, and require secure deployment practices for any third-party software that can open proxying or bandwidth-sharing capabilities.
- End users and administrators of home or small-business devices: avoid downloading software from untrusted sources, use strong credentials, apply available updates, secure configurations, and restrict network access where possible; GreyNoise also offers a free (account-required) service to check whether an IP address is part of a known legitimate or “gray” proxying service.
The central irony of this case is straightforward: a legitimate app designed to let users monetize spare bandwidth became the revenue engine for an illicit proxying operation once it was installed without consent. GreyNoise’s findings link specific exploited vulnerabilities and device classes to a wider operational goal — reselling stolen bandwidth through a commercial residential proxy network — and underscore the practical harms that can follow, from IP reputation damage to being implicated in credential-stuffing campaigns. Device owners and administrators who run NAS, NVRs, or other internet-facing systems are left with concrete, actionable steps: patch, harden credentials, restrict access, and verify whether their IPs are participating in proxy services.
