Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices and Create Proxy Networks

A coordinated cybercrime campaign has hijacked at least 143 devices across 34 countries by exploiting vulnerabilities in products from D‑Link, Ubiquiti and SAP.

Operators installed Pawns.app proxy software on compromised devices, converting their internet connections into residential proxy nodes. This lets the attacker route traffic through victims’ real IP addresses, making malicious activity harder to attribute and more likely to blend in with ordinary user traffic.

Researchers at GreyNoise uncovered the campaign and tied it to an actor tracked as “skynox7.” The group exploited known flaws in network-attached storage (NAS), network video recorders (NVRs) and an enterprise application to gain access, then installed proxy software that can appear legitimate when installed with consent — the concern is that it was installed and used without the owners’ permission.

How the attacker operated

GreyNoise reports the actor exploited four vulnerabilities across three product types: D‑Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs, and SAP NetWeaver Visual Composer. The specific CVEs reported are CVE‑2024‑3272 and CVE‑2024‑3273 (D‑Link ShareCenter), CVE‑2021‑44228 (Ubiquiti UniFi Video NVRs) and CVE‑2025‑31324 (SAP NetWeaver Visual Composer).

The D‑Link flaws affect certain ShareCenter NAS models; administrators should verify their specific model and firmware against vendor guidance rather than assume all D‑Link devices are impacted. The SAP issue targets the Metadata Uploader component of NetWeaver Visual Composer and can allow unauthenticated file uploads in vulnerable deployments. Including an enterprise app server in the campaign shows the actor targeted both consumer/small‑business edge devices and larger enterprise systems.

GreyNoise associates the Ubiquiti compromises with CVE‑2021‑44228 in UniFi Video NVRs but does not provide a device‑level breakdown or per‑product counts, so organizations should not assume all exposed Ubiquiti gear was affected.

After gaining access, the actor installed Pawns.app to enroll devices in a commercial residential proxy network. While such services have legitimate uses — for example, users voluntarily sharing bandwidth for payment or developers bundling proxy components in software — proxyjacking describes cases where proxy software is installed or used on someone else’s device without consent, monetizing the connection and leaving the device owner to absorb the risks.

GreyNoise also observed that, in some compromises, the attacker added SSH public keys as a persistent backdoor. SSH key authentication can allow the actor to retain access after the initial vulnerability is patched. The researchers noted the actor appeared to probe other DVR/NVR brands such as Hikvision and Dahua, though successful compromise of those brands was not confirmed in the report.

Compromised devices used as residential proxies can be leveraged to route activity aimed at unrelated targets, making that activity appear to originate from an ordinary home or office IP address. GreyNoise describes an investigation where multiple users authenticated from the same residential IP; that anomalous pattern led to further analysis that confirmed a significant intrusion.

Recommendations for defenders

Organizations should identify internet‑facing NAS devices, NVRs and SAP systems and confirm whether the affected products and components exist in their environment. Apply vendor updates or mitigations for the referenced vulnerabilities. If immediate patching is not possible, restrict access to management interfaces and vulnerable services, and remove unnecessary exposure to the public internet. For SAP NetWeaver, restrict access to the Metadata Uploader endpoint if you cannot patch right away.

Review authentication logs for signs of residential proxy usage, particularly when multiple users appear to sign in from the same IP address. GreyNoise recommends checking additional indicators beyond geography, such as device identifiers, session IDs and User‑Agent strings. A familiar IP location alone does not guarantee a login is legitimate: the same residential IP can simultaneously carry legitimate user traffic and proxy operator traffic.

Related reporting has shown proxyware can also be distributed via deceptive installers (for example, masquerading as a Notepad++ tool). Whether delivered through edge‑device exploits or deceptive software, proxyware that sells or shares bandwidth becomes harmful when installed without the owner’s knowledge or consent.

Indicators of compromise (IoCs)

Note: IP addresses and domains are sometimes intentionally defanged in public reporting to prevent accidental resolution or hyperlinking. Re‑fange indicators only within controlled threat‑intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with operational data from SOCs to improve detection and response.