Summary
A proxyjacking campaign discovered by GreyNoise has compromised at least 143 devices across 34 countries by exploiting known vulnerabilities in end-of-life D-Link ShareCenter NAS units and Ubiquiti UniFi Video NVR devices. Attackers silently install Pawns.app — a commercial bandwidth-sharing application — without device owner knowledge, monetizing victim internet connections through a residential proxy network. Both product lines are end-of-life with no patch pathway available.
Timeline
| Date | Event |
|---|---|
| Oct 15, 2026 | GreyNoise discloses proxyjacking campaign targeting end-of-life D-Link ShareCenter NAS and Ubiquiti UniFi Video NVR devices; 143+ devices compromised across 34 countries confirmed. |
What Happened
Attackers exploited CVE-2024-3272 and CVE-2024-3273 against D-Link ShareCenter NAS devices. CVE-2024-3272 is a hard-coded credential vulnerability; CVE-2024-3273 is a command injection flaw reachable via the nas_sharing.cgi endpoint. Both are unauthenticated and can be chained to achieve remote code execution. Against Ubiquiti UniFi Video NVR devices, attackers exploited CVE-2021-44228, the Log4Shell remote code execution vulnerability in Apache Log4j, present in firmware versions shipping the unpatched Log4j library. UniFi Video was discontinued by Ubiquiti in 2021 and receives no further updates.
Once code execution is achieved, attackers install Pawns.app, a legitimate commercial application that compensates users for sharing unused internet bandwidth with a residential proxy network. Installed without the device owner’s consent, the software routes third-party traffic — potentially including malicious traffic — through the victim’s residential or business IP address. Attackers also configure SSH key authentication on compromised devices to maintain persistent access independently of Pawns.app.
Device owners may notice increased bandwidth consumption and degraded network performance. More significantly, their IP addresses become part of a residential proxy pool used by unknown third parties. Both product lines are end-of-life with no patch pathway. Recommended remediation is decommissioning and replacing affected hardware. For organizations that cannot immediately replace devices, isolating them from internet-accessible network segments and disabling external management interfaces reduces exposure. Checking devices for unexpected running processes and reviewing SSH authorized_keys files for unrecognized entries are immediate detection steps.
Domain Intelligence
dlink.com — 62.78 / D
dlink.com scores in the low-trust range. One adverse signal noted from a single source without corroboration across independent sources reviewed. D-Link ShareCenter NAS devices are actively exploited in this campaign; the affected product line is end-of-life with no patch available.
ui.com — 62.82 / D
ui.com scores in the low-trust range. One adverse signal noted from a single source without corroboration across independent sources reviewed. Ubiquiti UniFi Video NVR devices are actively exploited via CVE-2021-44228; the product line was discontinued in 2021.