Proxyjacking Campaign Hijacks D-Link, UniFi Video and SAP Systems

A financially motivated actor tracked as skynox7 has quietly turned at least 143 devices across 34 countries into paid residential proxy exits. According to research published by GreyNoise, the operator broke into internet-facing storage boxes, video recorders and SAP servers using known — in some cases years-old — vulnerabilities, then enrolled them in a commercial bandwidth-sharing network without the owners ever knowing.

What happened

GreyNoise reconstructed the operation from an exposed attacker toolkit and its own sensor data. The workflow was simple and industrial:

• Recon — internet scan data was used to build a list of roughly 118,000 home routers, NAS appliances and video recorders.
• Initial access — four known flaws across three product families:
  • CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter (DNS-series) NAS devices
  • CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVRs
  • CVE-2025-31324 in the Metadata Uploader of SAP NetWeaver Visual Composer, which allows unauthenticated upload of executable files
• Install — the official Pawns.app client, renamed gotoschool and configured to restart on reboot. The attacker's script accepted Pawns.app's Terms of Use on the victim's behalf.
• Persistence — on some hosts the actor also added SSH keys, keeping a way back in even if the original flaw is later patched.
• Payout — the hijacked devices earned per-GB rewards for the attacker's account (around 282 GB shared for roughly $57 at the time of the research).

GreyNoise also saw the actor probing other DVR/NVR brands, including Hikvision and Dahua, but did not confirm successful compromises of those products. Likewise, there is no per-product breakdown of the 143 victims, so owners of exposed Ubiquiti or D-Link gear should not assume they were hit — but should check.

Why it matters

The payout here is small. The risk is not.

Proxyjacking is the abuse of legitimate bandwidth-sharing software on a device the operator doesn't own. Pawns.app itself is not malware — people install it voluntarily to sell spare bandwidth — which is exactly why this is hard to catch: the binary is legitimate, only the consent is missing.

Once a device is a residential proxy exit, anyone buying that proxy capacity can route traffic through your IP address. That traffic looks like a normal home or office connection, so it slips past geolocation-based login alerts and IP reputation checks. GreyNoise describes a real investigation where several different users authenticating from one residential proxy IP was the first clue to what turned out to be a serious intrusion elsewhere.

There is also a pattern worth noting: two of the three product families involved are old, edge-facing devices that rarely get attention, and the third is a business-critical SAP server. An unpatched box on the perimeter is never "just" a storage device.

What to do

1. Inventory your edge. Find every internet-facing NAS, NVR and SAP NetWeaver instance. Confirm whether the specific models and components above are present.
2. Patch or retire. Apply vendor fixes or mitigations. Several affected D-Link NAS models are end-of-life and UniFi Video has been discontinued — if no fix exists, take the device off the internet or replace it.
3. Lock down SAP Visual Composer. Apply SAP's fix for CVE-2025-31324; if you can't patch immediately, block or restrict access to the Metadata Uploader endpoint.
4. Shrink exposure. Management interfaces and vulnerable services should not be reachable from the public internet. Put them behind a VPN or allow-list.
5. Hunt for persistence. Check authorized_keys on Linux-based appliances for unknown SSH keys, and look for unexpected processes or services (e.g. one named gotoschool) and outbound proxy traffic.
6. Treat residential IPs as a signal, not a pass. In your sign-in logs, flag multiple accounts authenticating from the same residential IP, and correlate with device IDs, session identifiers and User-Agent strings — not location alone.

Indicators of compromise

GreyNoise has also published SHA-256 hashes of the Pawns.app binaries used. Remember those hashes match a legitimate application — a hit means "investigate whether this was installed with consent", not automatically "malware".

Not sure what your perimeter looks like from the outside? A 4Tify assessment maps your internet-facing assets and flags exactly these kinds of forgotten, unpatched devices before someone else monetizes them.

Source: original research by GreyNoise, as reported by Cyber Security News (16 October 2026).