GoKawiilHackers exploit D-Link, Ubiquiti and SAP flaws to sell victims' bandwidth
Researchers cited by BleepingComputer found attackers exploiting known vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver Visual Composer to install the Pawns.app bandwidth-sharing software on compromised devices. Hikvision and Dahua DVR/NVR units were also targeted, though the exact flaws used weren't identified, and in some cases attackers set up SSH key authentication to retain persistent access.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign turns unpatched network devices into a covert bandwidth-reselling network, meaning victims' internet connections could be used by third parties without their knowledge or consent. The use of SSH backdoors suggests attackers are aiming for long-term control, which could let them pivot to other malicious activity beyond bandwidth theft. It also underscores how older, known CVEs in consumer and enterprise IoT hardware remain exploitable years after disclosure.
- Attackers exploited CVEs in D-Link, Ubiquiti, and SAP products to install bandwidth-sharing software called Pawns.app.
- Hikvision and Dahua recorders were also targeted, though the specific exploited flaws remain unconfirmed.
- Some compromised devices had SSH key authentication configured, giving attackers persistent backdoor access.
D-Link ShareCenter NAS Replacement (Synology DS224+) — If you're running an aging D-Link ShareCenter or similar NAS vulnerable to the exploits described, it's a good time to upgrade to actively-patched hardware like Synology's DS224+. Synology has a strong track record of security updates and a more hardened management interface, reducing the risk of becoming part of a botnet. Pair it with proper firewall practices to keep your storage devices off the public internet.
See D-Link ShareCenter NAS Replacement (Synology DS224+) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: it.slashdot.org, 2026-10-16
Published there as: “Hackers Hijack D-Link, Ubiquiti Devices To Resell Your Stolen Bandwidth”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.