GoKawiilAttacker hijacks D-Link, Ubiquiti and other devices to sell bandwidth via Pawns.app
GreyNoise says it found at least 143 compromised devices across 34 countries silently enrolled in the Pawns.app residential proxy network without owner consent. The attacker exploited known flaws including CVE-2024-3272/3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer, and also targeted Hikvision and Dahua DVR/NVR devices. In some cases SSH keys were added for persistent backup access.
GoKawiil's interpretation of the reporting above, not reported fact.
By running Pawns.app on many hijacked devices, the operator likely multiplied payouts from the legitimate bandwidth-sharing service, turning victims' connections into unwitting revenue sources. GreyNoise and the FBI note that such proxy traffic can get device owners' IPs blocked or associated with abuse, including credential-stuffing attacks, even though they never knowingly joined the network. The case underscores how unpatched edge and IoT devices remain attractive entry points for monetized botnet-style abuse.
- At least 143 devices in 34 countries were secretly enrolled in the Pawns.app proxy network.
- Attackers exploited known CVEs in D-Link, Ubiquiti, and SAP products, plus likely Hikvision/Dahua DVRs.
- Victims risk IP blocks or suspicion of illegal activity due to proxied traffic routed through their connections.
D-Link Omna / UniFi Protect compatible secure router — If you're running NAS devices, NVRs, or IoT gear exposed to the internet, a router with built-in intrusion prevention and automatic firmware alerts can help stop exploits like the ones used in this proxyjacking campaign before they ever reach your devices. It's a practical first line of defense for anyone managing D-Link, Ubiquiti, or similar edge devices at home or in a small office. Pairing it with regular firmware updates goes a long way toward keeping your bandwidth and devices truly yours.
See D-Link Omna / UniFi Protect compatible secure router on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-15
Published there as: “Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.