GoKawiilAttacker hijacks D-Link, Ubiquiti and other devices to sell bandwidth via Pawns.app
GreyNoise says it found at least 143 compromised devices across 34 countries silently enrolled in the Pawns.app residential proxy network without owner consent. The attacker exploited known flaws including CVE-2024-3272/3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer, and also targeted Hikvision and Dahua DVR/NVR devices. In some cases SSH keys were added for persistent backup access.