Skip to content
Hackers Exploit D-Link and Ubiquiti Devices for Bandwidth Theft

Hackers Exploit D-Link and Ubiquiti Devices for Bandwidth Theft

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:20 UTC
  • •At least 143 devices across 34 countries were compromised in the proxyjacking campaign.
  • •Attackers exploited multiple CVEs to install Pawns.app on targeted devices.
  • •Users should update their systems and avoid untrusted software to mitigate risks.

A proxyjacking campaign has compromised at least 143 devices across 34 countries, hijacking internet connections by installing Pawns.app, a legitimate bandwidth-sharing application, without user consent. The attackers exploited vulnerabilities in D-Link ShareCenter NAS (CVE-2024-3272, CVE-2024-3273), Ubiquiti UniFi Video NVR (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324). The campaign was discovered by GreyNoise while investigating suspicious activity. The use of legitimate software allows attackers to monetize victims' internet connections while avoiding detection. Users of compromised devices may face IP address blocks or allegations of illegal activities. The FBI has previously warned about the risks associated with residential proxy networks. Users are advised to keep their devices updated and avoid untrusted software sources.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2021-12-10
CVE-2021-44228 published
Critical vulnerability in Ubiquiti UniFi Video NVR was published with a CVSS score of 10.0.
Bleepingcomputer
2024-04-04
CVE-2024-3272 and CVE-2024-3273 published
Critical vulnerabilities in D-Link ShareCenter NAS were published, with CVSS scores of 9.8 and 7.3.
Techradar
2025-04-24
CVE-2025-31324 published
Critical vulnerability in SAP NetWeaver Visual Composer was published with a CVSS score of 10.0.
Scworld

More articles in this cluster (3)

Following this threat?

Track Hikvision and CVE-2021-44228 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 3

Common questions

Which devices are affected?
D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver Visual Composer are affected.
How can I protect my devices?
Keep your devices updated, use strong credentials, and avoid downloading software from untrusted sources.
Is this campaign ongoing?
Yes, the campaign is currently active, with confirmed exploitation of the identified vulnerabilities.