143 Devices Compromised in Global Proxyjacking Campaign Using Legitimate App

A coordinated proxyjacking operation has impacted devices in 34 countries, according to threat intelligence firm GreyNoise. The attacker installed Pawns.app, a legitimate bandwidth-sharing application, on these systems without the owners’ knowledge. This software allows users to earn money by sharing their internet connections, but in this case, it was used to monetize stolen bandwidth through a commercial residential proxy network.

Which devices and vulnerabilities were exploited?

The attacker leveraged vulnerabilities in D-Link ShareCenter NAS systems and SAP NetWeaver Visual Composer instances to breach edge devices. GreyNoise identified the use of CVE-2024-3272 and CVE-2024-3273 in the D-Link hardware, as well as CVE-2025-31324 in the SAP software. The researchers also observed targeting of Hikvision and Dahua DVR and NVR devices, although the specific vulnerabilities used for those systems were not specified in the report.

How did the attackers maintain access and benefit?

By installing Pawns.app on multiple systems, the attacker likely accumulated larger payouts from the residential proxy network. The application routes traffic from other users through the compromised device’s network connection. GreyNoise noted that in some cases, the attackers configured SSH key authentication as a backup access method. This configuration served as an alternative means of entry for the operator to manage the compromised infrastructure.

What are the risks to the device owners?

Legitimate proxy networks can route suspicious traffic through volunteer-operated nodes due to insufficient oversight, potentially resulting in IP address blocks for participating users. Owners of compromised devices risk having their IP addresses blacklisted or being exposed to allegations of involvement in illegal activities. The FBI has previously warned that such networks are often used to carry out large-scale credential stuffing attacks against online platforms, meaning innocent users could be indirectly associated with criminal traffic.

How can teams verify if they are affected?

GreyNoise provides a free service, requiring an account, for users to check if their IP address is part of a known legitimate or “gray” proxying service. This tool allows users to determine if their IP is associated with these networks. Identifying such usage helps users understand if their connection is being utilized by a proxy service, which is a key indicator of compromise in this type of campaign.

Detection notes

Security operations teams should monitor for unexpected installation of bandwidth-sharing applications or unauthorized changes to SSH authorized_keys files. Network logs may show unusual outbound traffic patterns consistent with proxying, such as high-volume connections to diverse external IPs. Check for processes running under unexpected service accounts that match known legitimate proxy software names. Look for new outbound connections from edge devices that do not align with normal business operations. Investigate any sudden spikes in bandwidth usage from NAS or DVR devices that typically have low traffic profiles.

Background: Credential stuffing

Credential stuffing uses automated tools to test stolen username-password pairs against many websites. It succeeds because users reuse passwords across accounts. Defenders stop it by enforcing multi-factor authentication and detecting rapid, distributed login attempts that mimic human behavior.

Read the full guide: Credential Stuffing: How Attackers Reuse Stolen Logins to Break In

What to do and how to stay safe: Pawns.app

• Verify if your public IP addresses are listed in known proxy networks using available threat intelligence tools.
• Scan edge devices for the presence of unauthorized applications like Pawns.app or similar bandwidth-sharing software.
• Review SSH authorized_keys files on all internet-facing systems for unexpected public keys added by attackers.
• Ensure all NAS, DVR, and web application servers are patched against known vulnerabilities, including the specific CVEs mentioned.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific vulnerabilities were used in this campaign?

The attackers leveraged CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, and CVE-2025-31324 in SAP NetWeaver Visual Composer.

What application was installed on the compromised devices?

The attackers installed Pawns.app, a legitimate bandwidth-sharing application, to route traffic and monetize the stolen internet connections.

How many countries were affected by this campaign?

The proxyjacking campaign impacted devices in 34 countries, with at least 143 compromised devices identified worldwide.