A coordinated campaign pushed Pawns.app onto exposed devices, turning everyday gear into paid-for proxies in 34 countries.
A covert campaign turned D-Link and Ubiquiti devices into a paid proxy network. Researchers found at least 143 compromised devices in 34 countries, with Pawns.app installed to share bandwidth without owners’ consent.
What this means for you is simple: keep gear updated, use strong passwords, and watch for unfamiliar software running on devices at the edge of your network. If you’re unsure, isolate the device until you can verify it’s clean.
Next steps include applying firmware updates, reviewing device access, and considering a security check on your home router and connected devices.
Hackers quietly turned everyday internet gear into money machines. They hijacked D-Link and Ubiquiti devices, plus other exposed systems, and pushed an app called Pawns.app to resell stolen bandwidth. The campaign has been linked to at least 143 compromised devices across 34 countries, researchers say.
What makes this worrying isn’t just the breach itself. It’s that owners often didn’t notice the app running, and legitimate proxy networks can mask illegal activity. Your home router or NAS could be unknowingly helping someone traffic data for profit, all while you shoulder the risks of blocked IPs or mistaken accusations of misuse.
The attackers reportedly exploited known vulnerabilities to slip Pawns.app onto devices. In D-Link ShareCenter NAS, CVE-2024-3272 and CVE-2024-3273 were involved. For Ubiquiti UniFi Video NVR, CVE-2021-44228 played a role. A 2025 vulnerability, CVE-2025-31324, appears in SAP NetWeaver Visual Composer and was part of the broader intrusion chain. In some cases, attackers also used SSH keys as a backup access method.
GreyNoise, a threat-intelligence outfit, found evidence of these compromised devices during an unrelated investigation. They note that even legitimate, well-intentioned proxy networks can become conduits for traffic if owners don’t monitor what runs on their gear. And if your device is part of a proxy network, you could see slower speeds, blocked IPs, or even trouble proving your own online identity.
The FBI has highlighted residential proxy networks as a vehicle for large-scale credential stuffing and other abuses in the past. While Pawns.app is described as a legitimate bandwidth-sharing app that pays users, the fact that it was installed without consent makes this a serious privacy and security concern.
What should you do right now to protect yourself? Start with the basics: update firmware on NAS devices, video recorders, and other internet-facing systems; use strong, unique passwords; and disable unfamiliar services or SSH access if you don’t need them. If you’ve got a device that roles into your network and isn’t actively managed, consider that it could be a risk and isolate it from critical systems until you confirm it’s clean.
The bottom line: your internet connection is valuable, and so is your online reputation. Keeping devices updated and monitoring for unfamiliar software is more important than ever as attackers shift toward covert, revenue-driven campaigns like proxyjacking.
The campaign targeted edge devices like D-Link ShareCenter NAS and Ubiquiti UniFi Video NVR, plus other similar devices. If you own any internet-connected storage or camera systems that sit at the network edge, you should take a hard look at what’s running on them and when they were last updated. Even if you don’t remember installing Pawns.app, it could be present if a device was compromised by the vulnerability chain described above.
1) Update firmware and apps: patch all exposed devices and disable unnecessary services. 2) Change default credentials to strong, unique passwords. 3) Review device logs or dashboards for unfamiliar software. 4) If you’re unsure, consider unplugging or isolating devices until you can confirm they’re clean. 5) Run a security check on your router’s DNS and traffic patterns to spot unusual proxies or hidden traffic flows.
Your bandwidth isn’t just a resource you pay for. It’s part of your online identity. Being unknowingly added to a proxy network can complicate your online activity, expose you to blame for traffic you didn’t generate, and cause external blocks that affect legitimate use like streaming or gaming.
Security researchers and law enforcement are continuing to study these campaigns and push for stronger default protections on consumer edge devices. If you’re unsure about your own gear, the quickest step is to check for firmware updates and review what apps have permission to run on devices you own.
A campaign where attackers use unsecured devices to create and monetize a proxy network, routing other people’s traffic through compromised hardware.
Look for unfamiliar apps, unexpected network activity, or performance slowdowns. Check device dashboards and firmware versions against manufacturer sites.
Disconnect the device from the network, reset credentials, and apply any available firmware updates. If you’re not sure, contact the manufacturer’s support or a qualified security professional.
You're reading the quick version.
Read next
cross-border fiber optic scam exposed a 48-core line into Myanmar
Authorities in Thailand uncover a 350-meter, 48-core fiber line feeding a Myanmar scam compound and illegal border casino, highlighting how criminals exploit connectivity.
A Russian suspect tied to a global cyber‑crime gang is detained in Japan and connected to a 2024 hospital hack that disrupted blood testing and may have contributed to a death.
A broad phishing scam tied to political events aims to steal money and personal data as Americans head to the polls.
Data security is about keeping your personal information safe from leaks, misuse, and unauthorized access. Here’s a plain-English guide to how it works and why it matters.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
