Hackers Hijack D-Link and Ubiquiti Devices to Resell Victims' Bandwidth

The software the attackers installed, Pawns.app, is a legitimate application that rewards account holders for allowing traffic from other users to pass through their internet connections, provided those connections run on trusted, non-blocking IP addresses. By installing it on multiple systems, the attacker likely collected larger payouts than a single account would produce, the report says. Victims received no payment and had no part in the arrangement.

GreyNoise discovered the campaign while investigating suspicious activity at an organization the report does not name. Researchers traced the intrusions to known vulnerabilities that were exploited to place the software on the devices: CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS products, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer.

Hikvision and Dahua DVR and NVR devices were also targeted, though the report did not identify which vulnerabilities were used against those products. In some cases, the attackers also configured SSH key authentication so they could retain backup access to the systems they had compromised.

The campaign belongs to a category of abuse in which attackers resell other people's internet capacity rather than stealing data or encrypting files, leaving owners of the affected hardware to bear the bandwidth costs and any consequences of traffic routed through their addresses. The report does not say how long the devices remained enrolled or whether the operator's accounts with the proxy service have been closed.