Hackers hijack home network devices to resell victims' internet connections

Attackers found a way to turn other people’s network equipment into a business. By exploiting known flaws in devices from D-Link, Ubiquiti, SAP, Hikvision and Dahua, they installed Pawns.app, a bandwidth-sharing service, without the owners’ knowledge or consent.

The software is legitimate when a user chooses to run it. Pawns.app lets users earn rewards by sharing an internet connection and is a direct partner of IPRoyal. In this campaign, however, the attackers took control of the connections and resold them through a residential proxy network for profit.

That meant a victim’s IP address could serve as a relay for traffic sent by third parties. The resulting traffic could lead to blocked IP addresses or allegations that the owner was involved in illegal activity conducted through the compromised connection.

GreyNoise found the activity while examining suspicious behaviour at one organisation. It identified at least 143 compromised devices across 34 countries. The company published its analysis, titled 'skynox7: Proxyjacking Edge Devices Into Residential Proxies', on 15 October 2026 and linked the activity to the Pawns payout account [email protected].

The targeted equipment included D-Link ShareCenter network-attached storage devices, Ubiquiti UniFi Video network video recorders and SAP NetWeaver Visual Composer. The D-Link systems were exploited through CVE-2024-3272 and CVE-2024-3273, while the Ubiquiti devices were targeted through CVE-2021-44228, a vulnerability publicly known since December 2021. Attackers also used CVE-2025-31324 against SAP NetWeaver Visual Composer and targeted digital video recorder and network video recorder devices from Hikvision and Dahua.

Some of the equipment sits at an awkward point in the technology lifecycle. Many affected D-Link ShareCenter models are end-of-life, and the Ubiquiti UniFi NVR product line has been discontinued.

The operators sometimes added SSH key authentication to compromised hosts as a backup route in. GreyNoise said that choice suggested they expected to return even if their initial access was interrupted, pointing to an effort to retain access to the stolen connections.

Proxyjacking differs from ordinary bandwidth sharing because the device owner never agreed to the software being installed. For organisations caught in such a campaign, the immediate problem is loss of control over their connection. Traffic routed through it can expose them to IP blocks and reputational risk.