Verify Edge Devices for Unconsented Pawns.app Proxy Installations
GreyNoise found 143 devices in 34 countries hijacked for bandwidth resale via legitimate software installed without owner consent.
Key points
- Attackers exploited known flaws in D-Link, SAP, and Ubiquiti systems to install Pawns.app
- The campaign turned victim networks into residential proxy nodes for traffic routing
- No custom malware was used; the threat relies on unauthorized installation of legitimate apps
Security teams must audit edge devices for unauthorized installations of bandwidth-sharing applications. Threat intelligence firm GreyNoise identified a campaign that compromised at least 143 devices across 34 countries. The operators installed Pawns.app, a legitimate service that rewards users for sharing internet connections, on systems without the owners' knowledge. This allowed the attackers to monetize the victims' bandwidth by routing traffic through their IP addresses.
The risk
The primary danger lies in the covert use of legitimate software for illicit purposes. GreyNoise noted that the binaries associated with this campaign are not inherently malicious. The risk stems from their installation without consent. By using a trusted application, attackers can route traffic through residential IP addresses that appear normal to security tools. This makes it difficult to distinguish between legitimate user activity and compromised node traffic, potentially masking malicious operations such as credential stuffing.
Who is exposed
GreyNoise linked the activity to an actor tracked as "skynox7." The group exploited specific vulnerabilities to gain access to target systems. Affected products included D-Link ShareCenter NAS devices, which were hit via CVE-2024-3272 and CVE-2024-3273. SAP NetWeaver Visual Composer systems were compromised using CVE-2025-31324. Additionally, Ubiquiti UniFi Video network video recorders were targeted via CVE-2021-44228. The researchers also observed targeting of Hikvision and Dahua DVR/NVR devices, though specific vulnerabilities for those brands were not detailed.
Cost and compliance
The financial impact is indirect but significant for victims whose bandwidth is resold. According to the source material, legitimate proxy networks can route suspicious traffic through volunteer nodes due to insufficient oversight. This exposure can result in IP address blocks for participating users or allegations of involvement in illegal activities. The FBI has previously warned that such networks are used for large-scale credential stuffing attacks. GreyNoise provides a free service for users to check if their IP is part of a known proxy service.
Our take on the response
Managers should treat unauthorized legitimate software as a critical security event. The use of trusted binaries bypasses traditional malware detection, requiring teams to focus on process integrity and asset inventory. Ensuring that only approved applications run on edge devices is essential to prevent bandwidth hijacking.
What defenders should look for
Teams usually detect this activity by monitoring for unexpected outbound connections to known proxy service endpoints. Check whether bandwidth usage spikes correlate with unknown processes running on edge devices. Inspect system logs for the installation of legitimate applications that were not deployed by IT staff. Look for SSH key configurations that were added without administrative approval. Verify that all network-attached storage and video recorders are running approved software versions. Contain affected systems by isolating them from the network to stop traffic routing.
What to do and how to stay safe: GreyNoise
- Audit all internet-facing devices for the presence of Pawns.app or similar bandwidth-sharing software
- Verify that no unknown SSH keys have been added to device authentication configurations
- Check your IP addresses against GreyNoise's free proxy service to identify potential exposure
- Ensure all D-Link, SAP, and Ubiquiti devices are updated to patch the cited CVEs
Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific vulnerabilities were exploited in this campaign?
Attackers used CVE-2024-3272 and CVE-2024-3273 in D-Link NAS, CVE-2025-31324 in SAP NetWeaver, and CVE-2021-44228 in Ubiquiti NVRs.
Is Pawns.app considered malware?
No, GreyNoise states the binaries are not automatically malware; the issue is their installation and use without the owner's consent.
How many devices were compromised?
GreyNoise identified at least 143 compromised devices across 34 countries during their investigation.
