Hackers Turn Global Edge Devices Into Proxy Networks
A new campaign exploits known device vulnerabilities to resell unauthorized internet bandwidth to third parties.
Updated on Oct. 15, 2026 in Cybersecurity
Live Poll
Do you trust that your internet-connected devices are secure enough to prevent remote hijacking?
Hackers have compromised internet-connected devices in 34 countries to build a commercial proxy network. The attackers installed bandwidth-sharing software on hardware without owner consent to monetize stolen connections.
Why it matters
This campaign demonstrates how easily edge devices like network-attached storage and DVRs become nodes in illicit proxy networks. By exploiting known software vulnerabilities, attackers turn personal or office hardware into unauthorized bandwidth resellers.
GreyNoise identified 143 compromised units across 34 countries, representing a significant exploitation of edge device vulnerabilities. The campaign leverages multiple CVEs, including D-Link, Ubiquiti, and SAP flaws, to establish persistent access via SSH keys.
The players
GreyNoise
A cybersecurity firm that monitors and analyzes internet-wide scan and attack traffic to provide threat intelligence.
Pawns.app
A commercial platform that allows users to share their internet bandwidth for compensation.
The details
The attackers exploit known software vulnerabilities—CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter network-attached storage (NAS) devices, CVE-2021-44228 in Ubiquiti UniFi Video network video recorders, and CVE-2025-31324 in SAP NetWeaver Visual Composer—to breach hardware. Once inside, they install Pawns.app, a commercial bandwidth-sharing application that sells excess network capacity. To ensure persistence, the intruders configure SSH (Secure Shell) key authentication, a cryptographic method for secure remote login, as a backup access mechanism.
Timeline
October 15, 2026: The proxyjacking campaign findings were published.
The Tech Race
This campaign follows the well-documented pattern of automated exploitation established by the 2021 Log4j vulnerability. It underscores the ongoing race between vendors releasing security patches for edge devices and attackers automating the exploitation of those known flaws.
Users of D-Link, Ubiquiti, Hikvision, and Dahua hardware should audit their devices for unrecognized SSH keys or unexpected installed software. Owners are advised to apply the latest manufacturer patches immediately to mitigate the exploited CVEs.
The takeaway
The proliferation of proxyjacking highlights the critical risk of running unpatched internet-facing hardware. Users should prioritize updating network-attached storage and DVR devices to prevent them from being repurposed for unauthorized commercial traffic.
Further reading
For broader trends in device security, visit our Cybersecurity section.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust that your internet-connected devices are secure enough to prevent remote hijacking?
