Affected Systems

D-Link ShareCenter NAS (CVE-2024-3272, CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), SAP NetWeaver Visual Composer (CVE-2025-31324), and Hikvision/Dahua DVR/NVR devices. At least 143 compromised devices identified globally across 34 countries.

Exploitation Status

Active exploitation confirmed. Attackers are installing Pawns.app bandwidth-sharing software on compromised edge devices to monetize stolen internet bandwidth. SSH key authentication configured as persistence mechanism on some systems.

Business Impact

Compromised devices are enrolled in residential proxy networks without owner consent, routing potentially malicious traffic through victim IP addresses. Organizations face IP reputation damage, potential blocklisting, and legal exposure if their connections are used for credential stuffing or other attacks. Bandwidth theft impacts network performance. Attackers maintain persistent access via SSH keys.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately patch D-Link ShareCenter NAS devices against CVE-2024-3272 and CVE-2024-3273, or isolate from internet if patches unavailable
  • Update Ubiquiti UniFi Video NVR systems to versions patched for Log4Shell (CVE-2021-44228) or decommission if end-of-life
  • Patch SAP NetWeaver Visual Composer instances against CVE-2025-31324 and review for unauthorized SSH keys in authorized_keys files
  • Check organizational IP addresses using GreyNoise proxy detection service to identify enrollment in residential proxy networks
  • Audit all internet-facing edge devices (NAS, NVR, DVR) for unauthorized processes, SSH keys, and Pawns.app or similar bandwidth-sharing software
  • Implement network segmentation to isolate IoT and edge devices from critical infrastructure and restrict outbound connections

---

# Geopolitical Context

Geopolitical Context

This campaign represents a financially motivated exploitation of consumer and enterprise edge devices to monetize stolen bandwidth through commercial residential proxy networks. The targeting of D-Link, Ubiquiti, SAP, Hikvision, and Dahua products—spanning network-attached storage, network video recorders, and enterprise middleware—reflects the persistent vulnerability of internet-facing devices to known exploits. The use of legitimate bandwidth-sharing platforms like Pawns.app to launder illicit access demonstrates how threat actors exploit the gray economy of residential proxy services. While no state nexus is evident, the FBI has previously flagged such networks as vectors for credential stuffing and other cyber operations, underscoring their dual-use potential. The campaign's geographic spread across 34 countries suggests opportunistic scanning and exploitation rather than targeted intelligence collection, consistent with financially motivated cybercrime. The inclusion of CVE-2025-31324 (SAP NetWeaver) alongside older vulnerabilities indicates both rapid weaponization of new disclosures and continued exploitation of unpatched legacy systems.

State Actor Alignment

No state actor attribution is indicated in available reporting. The campaign appears consistent with financially motivated cybercrime leveraging commercial proxy monetization platforms. The FBI's prior warnings about residential proxy networks being used for credential stuffing attacks highlight potential dual-use concerns, as such infrastructure could theoretically support state-sponsored operations seeking anonymity. However, the current activity shows no indicators of state sponsorship or alignment with known advanced persistent threat (APT) groups. The use of legitimate commercial services for payout suggests profit-driven rather than strategic intelligence objectives.

Business Impacty pro region

The 34-country footprint reflects the global proliferation of vulnerable IoT and edge devices, particularly consumer-grade network equipment and video surveillance systems. European organizations face exposure through widespread deployment of affected D-Link, Ubiquiti, and Hikvision products in small-to-medium enterprises and critical infrastructure perimeters. The targeting of SAP NetWeaver—widely deployed in European manufacturing and logistics—raises concerns about enterprise exposure beyond consumer devices. For regions with limited cybersecurity capacity, compromised devices may facilitate broader criminal infrastructure, including botnet operations and anonymization services for ransomware or espionage actors. The FBI's credential stuffing warnings are particularly relevant for European financial services and e-commerce platforms that may unknowingly receive malicious traffic routed through compromised residential IPs. The campaign also highlights regulatory gaps in oversight of commercial proxy services, which operate in a legal gray zone across multiple jurisdictions.

Forecast

If the commercial proxy service ecosystem remains lightly regulated, similar proxyjacking campaigns are likely to persist and expand, targeting newly disclosed vulnerabilities in IoT and edge devices. If device manufacturers do not improve patch distribution mechanisms for end-of-life and consumer products, the pool of exploitable systems will continue to grow, particularly in regions with lower cybersecurity awareness. Should law enforcement increase scrutiny of residential proxy networks following credential stuffing incidents, operators may implement stricter verification measures, potentially reducing abuse but also driving threat actors toward more covert infrastructure. If enterprise organizations fail to segment and monitor edge devices, attackers may leverage proxyjacking footholds for lateral movement into corporate networks. The continued weaponization of recent CVEs (such as CVE-2025-31324) within months of disclosure suggests that rapid exploitation of enterprise-grade vulnerabilities will remain a feature of financially motivated campaigns targeting bandwidth monetization and other gray-market opportunities.