Attackers Turn Compromised Edge Devices Into Pawns.app Residential Proxy Nodes

Attackers compromised at least 143 internet-connected devices across 34 countries and used their bandwidth through the Pawns.app residential proxy network, according to GreyNoise research reported on October 15, 2026.

The figure represents devices, not unique people or organizations. The campaign’s start date was not reported.

Pawns.app is a legitimate bandwidth-sharing application that pays users who voluntarily allow third-party traffic to pass through their internet connection. In this operation, however, the software was installed without device owners’ consent. Deploying it across numerous compromised systems would allow the operator to collect payouts while using the victims’ connectivity and trusted IP addresses.

GreyNoise reportedly discovered the activity while examining suspicious traffic at an unnamed organization. In some compromises, the attacker also configured SSH key authentication, providing an additional way to regain access.

Four known vulnerabilities provided initial access

The reported intrusions involved flaws affecting legacy D-Link storage devices, an SAP NetWeaver component and software associated by the article with Ubiquiti UniFi Video NVR systems. All four vulnerabilities are in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

End-of-life D-Link NAS devices

Two remotely exploitable flaws affect the /cgi-bin/nas_sharing.cgi endpoint on D-Link products:

• CVE-2024-3272, CVSS 9.8, exposes hard-coded credentials through the user argument with the value messagebus.
• CVE-2024-3273, CVSS 7.3, permits command injection through the system argument.

The NVD descriptions identify DNS-320L, DNS-325, DNS-327L and DNS-340L devices up to 20240403. Its product data also includes DNS-120, DNR-202L, DNS-315L, DNS-320 and DNS-320LW; the only exact firmware version listed there is DNS-320L firmware 1.01.0702.2013.

Public exploits exist for both vulnerabilities. The affected products were already unsupported when the flaws were assigned, and CISA directs operators to retire and replace all associated end-of-life or end-of-service hardware revisions according to D-Link’s instructions.

Both CVEs entered the KEV catalog on 2024-04-11. The remediation deadline for US federal agencies was 2024-05-02.

Log4Shell reportedly used against Ubiquiti NVRs

The campaign report associates CVE-2021-44228, commonly known as Log4Shell, with Ubiquiti UniFi Video NVR devices. The NVD record confirms the underlying Apache Log4j vulnerability but does not list a Ubiquiti product, so it does not independently establish that product mapping.

CVE-2021-44228 allows an attacker who controls logged data or parameters to trigger code execution through attacker-controlled LDAP or other JNDI endpoints when message lookup substitution is enabled. It is specific to log4j-core; it does not affect log4net, log4cxx or other Apache Logging Services projects.

The NVD description covers Log4j2 2.0-beta9 through 2.15.0, excluding security releases 2.12.2, 2.12.3 and 2.3.1. It says 2.15.0 disabled the behavior by default, while 2.16.0, 2.12.2, 2.12.3 and 2.3.1 removed the functionality. Separately, the NVD product list records Apache Log4j versions below 2.3.1.

CISA added the vulnerability to KEV on 2021-12-10 and set 2021-12-24 as the federal remediation deadline. The agency records ransomware use and requires affected federal assets to be updated or removed from agency networks when updates exist. Temporary measures under ED 22-02 are acceptable only until updates become available.

SAP NetWeaver Visual Composer

CVE-2025-31324 is a CVSS 10 vulnerability in the SAP NetWeaver Visual Composer Metadata Uploader. Improper authorization allows an unauthenticated attacker to upload potentially malicious executable binaries, putting the host system’s confidentiality, integrity and availability at risk.

The NVD product listing identifies SAP NetWeaver 7.50. CISA added the flaw to KEV on 2025-04-29, with a federal remediation deadline of 2025-05-20, and records its use in ransomware campaigns. CISA instructs agencies to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue the product if mitigations are unavailable.

GreyNoise also reportedly observed targeting of Hikvision and Dahua DVR/NVR equipment, but the vulnerabilities used against those devices were not identified in the account.

Why proxyjacking affects more than bandwidth

An unauthorized proxy node can carry traffic generated by unrelated customers of the proxy service. The device owner may consequently see increased bandwidth consumption, IP reputation damage or access blocks imposed by online services. The report also warns that suspicious activity exiting through a victim’s connection could lead others to associate that IP address with abuse.

The additional SSH keys reported in some cases create a separate persistence concern. Removing Pawns.app alone would not necessarily eliminate access if an attacker-controlled key remained authorized.

Actions for device owners

Organizations operating exposed NAS systems, video recorders or SAP servers should first determine whether the affected products are reachable from the internet and then:

• Retire and replace the affected end-of-life D-Link hardware rather than relying on unsupported devices.
• Apply the relevant SAP mitigations to NetWeaver 7.50, or discontinue use where mitigations are unavailable.
• Update affected log4j-core deployments in line with CISA’s requirements.
• Inspect systems for unauthorized Pawns.app installations and SSH public keys that do not belong to approved administrators.
• Restrict administrative interfaces and SSH access to trusted networks or management paths.
• Rotate credentials where compromise is suspected and review network activity for unexplained proxy traffic.
• Avoid software packages from untrusted sources, particularly bundles that may enroll systems in residential proxy services without clear consent.

GreyNoise also provides an account-based service for checking whether an IP address is associated with a known legitimate or “gray” proxy network. For owners of affected edge devices, an unexpected match can support further investigation, but patching or replacing vulnerable equipment and removing unauthorized access remain the immediate priorities.