Cybercriminals breach network devices to siphon internet connections for cash

Security researchers at GreyNoise have discovered a global proxyjacking campaign that covertly hijacked at least 143 internet-connected devices across 34 countries. Attackers breached network storage and surveillance systems to install Pawns.app, a legitimate software platform designed to reward account holders with cash payouts in exchange for sharing their internet bandwidth. [1][2]

The threat actors capitalized on known vulnerabilities across several platforms, including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS units, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer systems. GreyNoise also observed attacks targeting Dahua and Hikvision DVR and NVR models. In some cases, the operators added SSH key authentication to preserve backup access to the compromised machines. [1][2]

Using authorized bandwidth-sharing software allows intruders to monetize residential connections while avoiding detection by traditional antivirus tools. Pawns.app previously announced it discontinued traffic sharing as of 2026, though older software versions and its developer toolkit still maintain the capability. Beyond having their bandwidth stolen, compromised organizations risk seeing their IP addresses blacklisted or tied to criminal cyber activity. [1][2]