New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure

A newly disclosed proxyjacking campaign has compromised at least 143 devices across 34 countries, exploiting vulnerabilities in network appliances and enterprise software to monetize victims’ internet connections.

GreyNoise identified an attacker installing Pawns.app, a legitimate bandwidth-sharing application, without device owners’ consent, turning compromised systems into commercial residential proxy nodes.

Unlike conventional VPN or hosting infrastructure, residential exit addresses can resemble legitimate users’ connections, weakening defenses that depend heavily on IP reputation or geographic anomalies.

According to GreyNoise’s investigation, the attacker exploited CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 in Ubiquiti UniFi Video NVR systems, and CVE-2025-31324 in SAP NetWeaver Visual Composer.

These compromises provided access for deploying the proxyware on victims’ infrastructure.

Researchers also observed targeting of Hikvision and Dahua digital and network video recorders, although the disclosed findings did not identify the vulnerabilities used against those products.

In some compromises, the attacker configured SSH key authentication as a backup access mechanism, creating another route into affected devices beyond the installed proxy application.

GreyNoise Researchers said that, the operation shows how attackers can generate revenue while expanding infrastructure that hides malicious traffic behind ordinary internet connections.

Proxyjacking Campaign

Pawns.app’s command-line variants accept account credentials and device information at runtime, allowing an installer to associate another device’s bandwidth with an operator-controlled account.

IPRoyal identifies Pawns.app as a direct residential-proxy sourcing partner. The abuse concerns unauthorized deployment of legitimate software, rather than evidence that either provider directed the campaign.

The research followed a separate incident uncovered during a live GreyNoise product demonstration.

An organization discovered IP addresses labeled malicious in its Microsoft Entra ID sign-in logs, even though those addresses appeared residential and geographically consistent with expected user activity.

Initial investigation established that the addresses belonged to residential proxy networks, but that finding alone could not establish whether the organization was compromised.

A legitimate user can share an outward-facing IP address with unrelated malicious traffic when a device behind that connection participates in a proxy network.

The stronger signal emerged when investigators found multiple users authenticating through the same residential address. Further investigation confirmed a serious intrusion.

GreyNoise withheld incident details, and the disclosed evidence does not establish that the intrusion and the subsequently identified proxyjacking operation shared an operator.

The broader technique has established precedents. In its Midnight Blizzard investigation, Microsoft documented attackers using distributed residential proxies to disguise password-spraying and subsequent access.

Rapidly changing addresses made traditional infrastructure-based indicators insufficient for reliable detection.

Separately, Sysdig documented Log4j-enabled proxyjacking in 2023, showing attackers installing proxyware instead of cryptocurrency miners.

That distinction matters operationally: monetizing network bandwidth can produce less conspicuous CPU activity than mining, allowing unauthorized software to escape resource-focused monitoring.

These historical findings provide context, not attribution for GreyNoise’s campaign.

Defenders should correlate suspicious sign-ins with identity behavior and device context rather than treating plausible geography as proof of legitimacy.

Microsoft recommends investigating unfamiliar authentication properties and password-spray activity.

GreyNoise also offers a free IP-checking service, requiring an account, to identify whether an address has interacted with its observation network; a match warrants investigation but does not independently prove proxyjacking or identify which device generated the observed traffic.

IOCs

IOC	Type	Description
e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd	SHA256	PAWNS APP
fdc18f4287c1c6a285c664d3ce0f17d3479bc246bc6c163eb90b1a84adb453a7	SHA256	PAWNS APP
4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7	SHA256	PAWNS APP
26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e	SHA256	PAWNS APP
df27938d26c1c9421ff307aafcb87131521e05f5d87ecaaab4a32ece3335fee4	SHA256	PAWNS APP

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.