---
title: Hunt: proxyjacking on edge devices: unwanted Pawns.app installs via old D-Link NAS, UniFi Video (Log4Shell) and SAP NetWeaver bugs | ctxsec
url: https://ctxsec.com/items/hunt-greynoise-pawns-proxyjacking
description: ""
status: "confirmed (GreyNoise research, Oct 15)"
published: 2026-10-16
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-greynoise-pawns-proxyjacking.md)

confirmed (GreyNoise research, Oct 15)

2026-10-16

### Hunt: proxyjacking on edge devices: unwanted Pawns.app installs via old D-Link NAS, UniFi Video (Log4Shell) and SAP NetWeaver bugs

GreyNoise (Oct 15) tracked an actor that compromised at least 143 devices in 34 countries and installed Pawns.app, a bandwidth-sharing client tied to IPRoyal, to sell victims' connections as residential proxy exits. Exploits used: D-Link ShareCenter NAS `CVE-2024-3272`/`CVE-2024-3273`, Ubiquiti UniFi Video NVR via Log4Shell `CVE-2021-44228`, and SAP NetWeaver Visual Composer `CVE-2025-31324`; Hikvision and Dahua DVR/NVRs were also targeted. Some victims got an attacker SSH key added as backup access. Hunt ideas: look for Pawns/IPRoyal binaries (GreyNoise publishes SHA256 hashes) or unexpected long-lived outbound proxy sessions from NAS, NVR and SAP hosts; review `authorized_keys` on edge devices for keys nobody owns; and in auth logs, flag several enterprise users signing in from the same residential-proxy IP or with mismatched device/session/User-Agent traits. These are all old, patched bugs, so the real fix is retiring or patching the forgotten box.

Sources: [GreyNoise: Proxyjacking edge devices into residential proxies](https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies) · [BleepingComputer (secondary)](https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/)