Hackers Hijack D‑Link and Ubiquiti Devices to Resell Victims’ Bandwidth via Unauthorized Proxy Software
What Happened — Attackers leveraged multiple publicly‑known vulnerabilities (CVE‑2024‑3272, CVE‑2024‑3273 in D‑Link ShareCenter NAS; CVE‑2021‑44228 in Ubiquiti UniFi Video NVR; CVE‑2025‑31324 in SAP NetWeaver Visual Composer) to gain remote access to edge devices in 34 countries. They installed the legitimate‑looking Pawns.app proxy client without owner consent, turning the compromised devices into residential proxy nodes that were then monetised on a commercial bandwidth‑sharing marketplace.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must surface unauthorized software installations on network‑edge assets, providing defensible evidence that configuration baselines are being enforced.
- Patch‑management and credential‑hardening controls are only as strong as the evidence you can produce; a breach like this highlights the need for automated, auditable proof of compliance across the device lifecycle.
- Demonstrating that you monitor for rogue SSH keys and unexpected binaries directly supports control objectives around configuration integrity and access control.
Who Is Affected – Organizations that expose NAS, video‑surveillance NVRs, or other internet‑facing appliances – including ISPs, managed‑service providers, retail locations, manufacturing plants, and any enterprise that runs on‑prem edge hardware.
Recommended Actions
- Inventory all internet‑exposed devices and map them to a patch‑status dashboard.
- Enforce strong, unique credentials and disable password‑based SSH where possible; rotate keys regularly.
- Deploy continuous configuration‑compliance monitoring that flags unknown binaries or processes (e.g., Pawns.app).
- Capture and retain evidence of patch levels and access‑control logs for audit readiness.
Source: BleepingComputer
Technical Notes – The campaign used CVE‑2024‑3272/3273 (remote code execution in D‑Link ShareCenter), CVE‑2021‑44228 (Log4j‑related exploit in Ubiquiti UniFi Video), and CVE‑2025‑31324 (remote code execution in SAP NetWeaver Visual Composer). Attackers also configured persistent SSH keys as a fallback access method. The installed Pawns.app runs as a background service, routing third‑party traffic through the victim’s IP address. Source: same