GreyNoise 'skynox7': proxyjacking actor exploits old D-Link NAS, Log4Shell in UniFi Video and SAP NetWeaver bugs to install Pawns.app bandwidth-sharing software on at least 143 edge devices in 34 countries
GreyNoise published research, reported by BleepingComputer on 15 October 2026, on a proxyjacking campaign by an actor it tracks as skynox7. The actor breaks into internet-facing edge devices and installs Pawns.app, a legitimate bandwidth-sharing app (a rebrand of IPRoyal Pawns that feeds IPRoyal's residential proxy pool), without the owners' consent, so the attacker is paid for the victims' internet connections. GreyNoise counted at least 143 compromised devices in 34 countries. The exploits used were CVE-2024-3272 and CVE-2024-3273 in end-of-life D-Link NAS devices, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer; Hikvision and Dahua DVR/NVR devices were also targeted, but GreyNoise did not say which flaws. In some cases the actor added SSH key authentication as a backup way back in. GreyNoise found the activity while helping an organisation that had spotted GreyNoise-flagged residential IPs in its Entra ID sign-in logs, which turned out to be a real intrusion. Its point is that residential proxies defeat 'impossible location' and VPS-reputation checks, and that an IP can carry both legitimate logins and an attacker's traffic. GreyNoise has not published a per-country list. Primary: GreyNoise; wire: BleepingComputer.
- Product
- Internet-facing edge devices: D-Link NAS (end-of-life), Ubiquiti UniFi Video NVR, SAP NetWeaver Visual Composer, Hikvision/Dahua DVR/NVR
- Versions
- Known n-day CVEs: CVE-2024-3272 / CVE-2024-3273 (D-Link NAS, no fix — devices are end-of-life), CVE-2021-44228 (Log4Shell in UniFi Video), CVE-2025-31324 (SAP NetWeaver Visual Composer)
- Exploited in Australia?
- unknown
- Patch to
- Retire end-of-life D-Link NAS and UniFi Video NVRs or pull them off the internet; patch SAP NetWeaver for CVE-2025-31324. Look for Pawns.app/IPRoyal processes and unexpected SSH authorized_keys on NAS, NVR and DVR boxes. In identity logs, do not treat residential or in-country IPs as automatically safe; correlate sign-ins with device and session signals.
Primary: GreyNoise — skynox7: Proxyjacking edge devices into residential proxies · Vendor: GreyNoise research (primary) · CVE: CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, CVE-2025-31324 · BleepingComputer — Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth (15 Oct 2026)