D-Link, Ubiquiti devices hijacked by hackers to plunder stolen bandwidth
Someone hacked network-attached devices to install... legitimate software? For nefarious purposes, still.
Hackers hijacked D-Link and Ubiquiti devices to exploit their bandwidth for illegal purposes, according to security researchers GreyNoise. The attack involved compromising at least 143 devices in 34 countries. Proxyjacking, a type of cyber attack, allows threat actors to use compromised endpoints for anonymously conducting criminal activities without installing malicious software.
Instead, hackers installed a legitimate app called Pawns.app, which provided bandwidth-sharing features. Although the app discontinued this feature, older versions still allowed it, making it a loophole for attackers to exploit. The vulnerable devices included D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs, and SAP NetWeaver Visual Composers, among others.
The researchers found that these devices were compromised due to unpatched vulnerabilities, such as CVE-2024-3272 and CVE-2024-3273 for D-Link, CVE-2021-44228 for Ubiquiti, and CVE-2025-31324 for SAP. GreyNoise warned that proxyjacking is a crime, as it involves forcing devices into proxy networks to monetize their bandwidth without the owners' knowledge or consent.
To mitigate the risk, businesses are advised to educate employees about the dangers of installing free apps and the importance of patching devices. Additionally, they should monitor authentication logs for residential proxy IP addresses and detect deviations in user authentication behavior and characteristics beyond geolocation.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
