Proxyjacking Campaign Hijacks D-Link, SAP Devices for Stolen Bandwidth

Threat intelligence firm GreyNoise identified a proxyjacking campaign that compromised edge devices in 34 countries. The attackers installed the legitimate bandwidth-sharing application Pawns.app on victim systems without consent, monetizing the stolen internet connections through a commercial residential proxy network. According to BleepingComputer, the operation relied on exploiting known vulnerabilities to gain initial access to the target infrastructure.

The researchers found that the threat actor leveraged CVE-2024-3272 and CVE-2024-3273, vulnerabilities found in D-Link ShareCenter NAS devices. They also exploited CVE-2025-31324 in SAP NetWeaver Visual Composer to breach networks. By installing the application on multiple systems, the attacker likely accumulated larger payouts from the proxy network, which rewards users for allowing traffic to flow through their trusted IP addresses.

Technical Context and Scope

GreyNoise discovered this campaign while investigating suspicious activity at an unnamed organization. The investigation revealed at least 143 compromised devices worldwide participating in the illicit bandwidth sharing scheme. In some cases, the attackers configured SSH key authentication as a backup access method to maintain persistent control over the hijacked devices and ensure the proxy software remained operational.

The campaign also targeted Hikvision and Dahua DVR and NVR devices. However, the researchers did not specify which vulnerabilities were exploited to compromise these video surveillance systems. The use of legitimate applications like Pawns.app complicates detection, as the traffic appears to originate from trusted, non-blocking IP addresses rather than obvious malicious sources.

Risks to Victims

Legitimate proxy networks can route suspicious traffic through volunteer-operated nodes due to insufficient oversight. This exposure can result in IP address blocks for participating users or expose them to allegations of involvement in illegal activities. The FBI previously warned that such networks are used to carry out large-scale credential stuffing attacks against online platforms, masking the true origin of the malicious traffic.

Victims in this campaign are unaware that their internet connections are being sold. The monetization of stolen bandwidth occurs silently, with the attacker collecting rewards while the victim bears the reputational and security risks. That suggests the financial incentive for attackers to use legitimate proxy infrastructure rather than building their own botnets is significant and growing.

What should you do?

Users should check if their IP address is part of a known proxying service using GreyNoise’s free tool. An account is required to access this service. Monitoring for unauthorized SSH keys and unexpected application installations on network devices is also critical. While no specific fix was confirmed for the entire chain, keeping devices updated reduces the risk of compromise through known CVEs.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: D-Link

• Check your public IP address against GreyNoise’s proxy database to see if it is being used in residential proxy networks.
• Review SSH authorized_keys files on all edge devices to remove any unknown or unauthorized public keys that could grant persistent access.
• Verify that no unknown applications, such as Pawns.app, are installed or running on network-attached storage and surveillance devices.
• Ensure that D-Link NAS, SAP NetWeaver, and video recording devices are updated to the latest firmware versions to patch known vulnerabilities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific vulnerabilities were exploited in this campaign?

Attackers exploited CVE-2024-3272 and CVE-2024-3273 in D-Link NAS devices, and CVE-2025-31324 in SAP NetWeaver Visual Composer.

How many devices were compromised in this attack?

GreyNoise identified at least 143 compromised devices across 34 countries.

Is there a patch available for the compromised devices?

The source material does not confirm that a patch has been released for all affected systems or vulnerabilities.