D-Link, Ubiquiti devices hijacked by hackers to plunder stolen bandwidth

Date:
Fri, 16 Oct 2026 16:30:00 +0000

Description:
Someone hacked network-attached devices to install... legitimate software?
For nefarious purposes, still.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Attackers exploited vulnerable devices to install legitimate bandwidth-sharing software and hijack internet connections Compromised systems were covertly added to proxy networks, enabling anonymous criminal activity Campaign affected at least 143 devices across 34 countries, highlighting patching and access-control failures When threat actors break into a system, they dont need to install malware to make use of the compromised endpoint - they can install perfectly legal, normal software, and still walk away with a paycheck they didnt earn.

A recent proxyjacking campaign spotted by security researchers GreyNoise impacted hundreds of devices in dozens of countries. Proxyjacking
Proxyjacking is a type of attack in which a device is hijacked and
assimilated into a proxy network. Usually, cybercriminals would break into a computer, install malware and create a proxy network of their own, which they can later rent or use themselves. Threat actors are always in need of clean and unflagged devices and IP addresses behind which they can hide, making residential proxies - both malicious and legal - highly wanted services. Latest Videos From TechRadar Watch full video here:

Some of the biggest malicious residential proxies out there include IPIDEA, NetNut, and Cloudrouter. All of them are now either entirely dismantled, or severely disrupted, but while they were operational, they offered hundreds of thousands (sometimes millions) of IP addresses associated with an internet connection used in a household (hence the name residential IP address).

But malicious proxies are difficult to pull off. To assimilate a device into the network, the threat actor needs to deploy malware which, as soon as its spotted, will be flagged by antivirus products and quarantined. In the newest attacks, spotted by GreyNoise, someone went for a legitimate app with similar functionality, instead. You may like Hackers use fake Adobe and Zoom updates to load malware onto victim devices Hackers build fake desktop apps to trick victims into handing over access Travelers beware Microsoft experts warn hotel Wi-Fi can be hijacked to infect your devices with dangerous malware

The researchers found someone installing Pawns.app, primarily a rewards platform that lets users earn money by completing online surveys and playing games. However, it used to offer a bandwidth-sharing feature that let users earn money by allowing business clients to route their internet traffic through the users residential IP address. At the start of the year, the app discontinued the feature, but it seems it still works for older versions.

As of 2026, Pawns.app does not offer internet bandwidth sharing, a notification on the apps website reads. This feature was discontinued and is not associated with Pawns.app anymore. But the apps Terms of use still describe traffic sharing as available in some versions of the application,
and its business website still promotes an SDK for bandwidth monetization.
Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. Targeting D-Link Apparently, someone picked
up on this and went to work. According to GreyNoise, they targeted D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs, as well as SAP NetWeaver Visual Composers. These contained different vulnerabilities: CVE-2024-3272
and CVE-2024-3273 for D-Link, CVE-2021-44228 for Ubiquiti, and

CVE-2025-31324 for SAP, which the threat actor leveraged to deploy Pawns.app. GreyNoise also said that the attackers targeted Hikvision and Dahua DVR/NVR devices, but did not say which vulnerabilities they leveraged against these devices.

At the moment of publication, the researchers identified at least 143 compromised devices worldwide, located in 34 different countries. While they all had legitimate software installed, it was deployed without their
knowledge or consent, making the entire ordeal illegal. What to read next Hackers turn business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge Microsoft login pages are being abused as hackers try and lure in unlucky victims Hundreds of fake Chrome VPN extensions caught hijacking your traffic

While earn on your internet is voluntary, proxyjacking is a crime. Proxyjacking is when an MCA (malicious cyber actor) forces victim devices
into proxy networks in order to monetize their bandwidth, GreyNoise warned.

If youre worried someone might have done something similar to a device under your control, GreyNoise created a free service that lets you check if your IP interacted with its Global Observation Grid. The researchers said it can
serve as a potential indicator of proxyjacking.

Apart from scanning IP addresses, businesses should educate employees about the risks associated with installing free apps, as well as about the importance of keeping devices patched. They should also detect residential proxy IP addresses in authentication logs, as well as deviations in user authentication behavior and characteristics beyond geolocation, such as mismatches in device identifiers, or session identifiers.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/d-link-ubiquiti-devices-hijacked-by-hac kers-to-plunder-stolen-bandwidth


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)