A sophisticated proxyjacking campaign is actively exploiting vulnerabilities in network edge devices, turning unsuspecting users' internet connections into a revenue stream for threat actors. The campaign, which has impacted devices in 34 countries, involves the unauthorized installation of **Pawns.app**, a legitimate application designed for users to earn money by sharing their bandwidth. ### The Mechanics of Proxyjacking The attackers are leveraging compromised devices to run **Pawns.app** without the owners' consent. This allows them to accumulate larger payouts by routing traffic through a network of hijacked systems. **Pawns.app** rewards users for permitting other users' traffic to flow through their network, provided the IP addresses are trusted and non-blocking. .jpg) *Source: GreyNoise* Threat intelligence firm **GreyNoise** discovered the campaign during an investigation into suspicious activity at an unnamed organization. Their research identified at least 143 compromised devices globally, highlighting the campaign's broad reach. ### Exploited Vulnerabilities **GreyNoise** researchers pinpointed several key vulnerabilities exploited to breach these edge devices and install the **Pawns.app** software: * **CVE-2024-3272** and **CVE-2024-3273** in **D-Link ShareCenter NAS** devices. * **CVE-2021-44228** in **Ubiquiti UniFi Video NVR** systems. * **CVE-2025-31324** in **SAP NetWeaver Visual Composer**. Additionally, the campaign has targeted **Hikvision** and **Dahua DVR/NVR** devices, though specific vulnerabilities for these systems were not detailed. In some instances, attackers established **SSH** key authentication as a backup access method, ensuring persistent access to compromised systems.  **Configuring SSH access** *Source: GreyNoise* ### Risks of Residential Proxy Networks The use of residential proxy networks, even legitimate ones, carries inherent risks. Insufficient oversight can lead to suspicious or malicious traffic being routed through volunteer-operated nodes. This can result in IP address blocks for participating users or, worse, expose them to accusations of involvement in illegal activities. The **FBI** has previously issued warnings about such networks being leveraged for large-scale credential stuffing attacks against online platforms. ### Mitigation and Prevention **GreyNoise** offers a free service (account required) for users to verify if their IP address is part of a known legitimate or 'gray' proxying service. To mitigate the risk of falling victim to such campaigns, IT security professionals and privacy-conscious users should adhere to several best practices: * **Software Downloads**: Avoid downloading software from untrusted sources, as seemingly free applications can often conceal malware that enrolls devices in residential proxy networks. * **Patch Management**: Regularly update NAS devices, video recorders, and other internet-facing systems. Exploiting known vulnerabilities is a common tactic for threat actors. * **Strong Credentials**: Implement strong, unique passwords and secure configurations for all network devices. * **Network Access Restrictions**: Limit network access to only essential services and trusted sources.