GreyNoise has identified a campaign that hijacks edge devices from vendors including D-Link and Ubiquiti and uses them to resell victims’ internet bandwidth. The researchers found at least 143 compromised devices across 34 countries, and the operator earns payouts by routing traffic from a commercial residential proxy network through the victims’ connections.
How GreyNoise Found the Campaign
GreyNoise discovered the activity while investigating suspicious behavior at an unnamed organization, and the findings were published October 15. The firm identified at least 143 compromised devices worldwide in 34 countries. GreyNoise has not stated when the campaign began, so the findings are best read as newly published rather than as a dated operation.
Pawns.app: A Legitimate Bandwidth-Sharing App Installed Without Consent
The operator exploited several vulnerabilities in edge devices and then installed Pawns.app, a legitimate bandwidth-sharing application, on them without the owners’ consent. With the app running, traffic from a commercial residential proxy network flows through the victim’s connection and the attacker collects the payouts. This practice is known as proxyjacking.
The specific vulnerabilities exploited were not identified in the coverage of the report reviewed here, so defenders cannot yet match the activity to particular firmware versions or patches.
SSH Key Authentication Added as a Backup Access Method
In some cases the attacker also added SSH key authentication as a backup access method. That addition gives the operator a way back into a device even if the proxy application is removed or the original entry point is closed.
Hikvision and Dahua DVR and NVR Devices Also Targeted
GreyNoise reported that Hikvision and Dahua digital and network video recorders were also targeted in the campaign. The flaws exploited against those devices were not specified.
Which Devices Were Hit
The named vendors cover several device categories. D-Link and Ubiquiti products are networking equipment, and Hikvision and Dahua make DVR and NVR recorders, the video recording boxes that often sit on home and business networks. GreyNoise’s count of at least 143 devices in 34 countries is a minimum rather than a confirmed total. The first signs appeared during an investigation of suspicious activity at an unnamed organization, and the firm has not said how many other devices may be affected.
Risks to Device Owners
The compromised devices lose bandwidth to the proxy traffic, and owners may be blamed for abusive activity routed through their addresses. The risks include having the device’s IP address blocked or being implicated in illegal activity conducted through the proxy network.
The FBI has warned that residential proxy networks of this kind are used for large-scale credential stuffing. A hijacked home or small-office device can therefore serve as the apparent source of login attacks against other organizations, while the legitimate owner has no knowledge that the traffic is passing through.
GreyNoise’s Free Lookup for Gray Proxy IPs
GreyNoise offers a free lookup that lets people check whether an IP address is a gray proxy IP. The guidance accompanying the report is to keep network-attached storage devices, recorders and routers updated, use strong credentials and restrict network access.
What the Campaign Shows About Monetizing Edge Devices
The campaign monetizes access in a quiet way. The compromise does not need to steal data or encrypt files, since the profit comes from the bandwidth itself, and the only sign to an owner may be slower connections. That low visibility helps explain how at least 143 devices in 34 countries could be recruited before a researcher noticed them while looking into something else.
The unresolved details, including the exploited vulnerabilities, the campaign’s duration and the number of devices beyond the 143 identified, determine how widely the same entry points could be reused by other operators.
