GreyNoise (Oct 15) tracked an actor that compromised at least 143 devices in 34 countries and installed Pawns.app, a bandwidth-sharing client tied to IPRoyal, to sell victims' connections as residential proxy exits. Exploits used: D-Link ShareCenter NAS CVE-2024-3272/CVE-2024-3273, Ubiquiti UniFi Video NVR via Log4Shell CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324; Hikvision and Dahua DVR/NVRs were also targeted. Some victims got an attacker SSH key added as backup access. Hunt ideas: look for Pawns/IPRoyal binaries (GreyNoise publishes SHA256 hashes) or unexpected long-lived outbound proxy sessions from NAS, NVR and SAP hosts; review authorized_keys on edge devices for keys nobody owns; and in auth logs, flag several enterprise users signing in from the same residential-proxy IP or with mismatched device/session/User-Agent traits. These are all old, patched bugs, so the real fix is retiring or patching the forgotten box.