# Attackers Install Bandwidth-Sharing Software on Compromised Network Hardware

Attackers compromised at least 143 network devices across 34 countries by exploiting known vulnerabilities in edge hardware and installing bandwidth-sharing software without owner consent. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization. The intruders installed Pawns.app, a legitimate application that pays users to route traffic through their internet connections. In this case the attacker collected earnings while victims unknowingly provided residential IP addresses that could carry third-party traffic.

## How Attackers Compromised the Devices

The attacker leveraged several vulnerabilities to breach edge devices. GreyNoise identified CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR and CVE-2025-31324 in SAP NetWeaver Visual Composer. The researchers also observed targeting of Hikvision and Dahua DVR and NVR devices but did not specify the vulnerabilities exploited.

After gaining access, the attacker installed the Pawns.app client. In some cases attackers configured SSH key authentication as a backup access method, according to GreyNoise. By running the software on multiple breached devices, the operator likely accumulated larger payouts from the bandwidth-sharing platform.


## What Pawns.app Does

Pawns.app is a commercial residential proxy network that rewards account holders for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. Legitimate users consent to share their internet connections and earn money when platform customers route traffic through their IP address.

In this campaign the device owner never authorized installation. The attacker collected earnings while compromised device owners unknowingly provided the residential IP addresses. The victim's connection could carry credential stuffing or other abuse, potentially resulting in IP address blocks.


## Risks Associated with Residential Proxy Networks

Even legitimate proxy networks can route suspicious traffic through volunteer-operated nodes when oversight is insufficient, according to the GreyNoise report. Law enforcement has publicly warned that operators have used these networks to launch credential stuffing campaigns targeting online platforms at scale.

GreyNoise provides a free service that requires an account for users to check if their IP address is part of a known legitimate or gray proxying service. If you discover unauthorized proxy software, disconnect the device from the internet, remove the client application and scan for malware.


## Campaign Scope

The campaign impacted devices in 34 countries. GreyNoise identified at least 143 compromised devices worldwide in its investigation. The breached systems include D-Link ShareCenter NAS units, Ubiquiti UniFi Video NVR devices, SAP NetWeaver Visual Composer servers, and Hikvision and Dahua DVR and NVR devices.

The attacker targeted devices with published exploits. CVE-2021-44228 was patched years before this campaign, indicating some compromised devices were running significantly outdated software at the time of the attack.


## How to Protect Your Devices

Keep firmware current on NAS devices, video recorders and other internet-facing systems. Use strong credentials and disable default accounts. Restrict management interfaces to trusted networks. If a device does not need to be reachable from the public internet, place it behind a firewall or VPN.

Check running processes periodically. Unexpected bandwidth spikes or unfamiliar binaries may signal compromise. Avoid downloading software from untrusted sources, as purportedly free software may contain malware that enrolls devices in residential proxy networks.
1. Apply vendor firmware updates as soon as they become available
2. Change default passwords to strong, unique credentials
3. Disable unused accounts and services
4. Restrict management interfaces to local network or VPN access
5. Monitor bandwidth usage for unexpected spikes
6. Review running processes for unfamiliar software
7. Download applications only from trusted sources

## What This Means for Network Security

The campaign illustrates how attackers monetize access through infrastructure abuse rather than data theft. The attacker rented out victim internet connections as a commodity. When malicious traffic emerges from residential IP addresses, defenders cannot easily distinguish compromised nodes from consenting proxy participants.

Organizations should monitor outbound traffic patterns and baseline bandwidth consumption to detect anomalies that suggest unauthorized proxy use. Residential networks that show sustained proxy traffic behavior despite no installed legitimate application warrant investigation.


## How can I check if my device is enrolled in a proxy network

GreyNoise offers a free service that requires an account to check whether your IP address appears in a known legitimate or gray proxy network. Unexpected bandwidth usage, unfamiliar processes or software you did not install may also indicate compromise.

## What vulnerabilities did the attackers exploit

GreyNoise identified CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR and CVE-2025-31324 in SAP NetWeaver Visual Composer. The researchers also observed compromises in Hikvision and Dahua devices but did not specify which vulnerabilities were exploited.

## Is Pawns.app itself malicious software

No. Pawns.app is a legitimate bandwidth-sharing application that pays users to route traffic through their internet connections. The issue arises when attackers install it on devices without owner consent, collecting earnings while victims unknowingly provide residential IP addresses.

## What should I do if I find unauthorized proxy software on my device

Disconnect the device from the internet immediately. Remove the proxy client software and scan for malware. Change all passwords and check for unauthorized SSH keys or other persistence mechanisms. Report the compromise to your internet service provider.

## How does proxyjacking differ from other attacks

Proxyjacking monetizes access by reselling victim internet connections rather than stealing data or deploying ransomware. Attackers earn money through proxy platforms that handle billing, while victims unknowingly provide residential IP addresses that may carry third-party traffic.

Source: BleepingComputer
Published: 2026-10-19T00:27:54+00:00