Proxyjacking Turns NAS and Video Devices Into Exit Nodes
GreyNoise reports attackers installing bandwidth-sharing software on vulnerable equipment without consent. The priority is securing the device, not hiding your laptop behind another VPN.
The short version
What you need to know
- GreyNoise says an attacker compromised at least 143 devices in 34 countries and installed Pawns.app to monetise their internet connections.
- The report concerns unauthorised installation of legitimate bandwidth-sharing software, not proof that every Pawns.app user or residential proxy is malicious.
- Check internet-facing storage and video equipment for support, updates and unnecessary remote access. A VPN on another device will not remove the compromise.
What GreyNoise found
In research published on 15 October, GreyNoise describes an attacker forcing vulnerable network-edge equipment into a commercial residential proxy network. It says at least 143 devices across 34 countries were compromised. The attacker installed Pawns.app without the owners' consent so other traffic could use those connections and generate revenue for the attacker.
The report identifies exploitation of CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer. It also describes apparent targeting of Hikvision and Dahua recorders, without identifying corresponding exploited vulnerabilities for those brands. This is not a claim that every product from these manufacturers is affected.
Why this differs from choosing a proxy
A residential proxy lets someone else's traffic reach websites through a participating connection's public IP address. Voluntary bandwidth sharing and proxyjacking are different: here, the device owner did not agree to participate. GreyNoise explicitly notes that the software binaries are not necessarily malware when installed with consent.
Our earlier NetNut explainer covered a separate residential-proxy disruption and streaming-device risks. This report adds a different route into a household or small business connection: exploitation of storage and video infrastructure. Checking only the apps on your phone would miss that equipment.
What device owners should check
Identify the exact model and firmware of internet-facing storage and video recorders. Check the manufacturer's support status and official security guidance. Apply supported fixes; if the equipment no longer receives security updates, plan replacement rather than assuming a newer password repairs vulnerable software.
Review unnecessary port forwarding and internet-accessible administration with whoever manages the network. For workplace equipment, involve IT before changing access settings. These are precautionary checks, not evidence that your own device is infected.
If you find unexplained software or access, isolate the suspect equipment and seek vendor or IT help with recovery. GreyNoise observed attacker SSH keys added as a backup access method in some cases, so deleting one bandwidth-sharing program is not reliable proof that access has been removed.
Why a personal VPN is not the cleanup
A VPN on your laptop protects traffic routed through that tunnel; it does not patch or disinfect a separate NAS or video recorder. Even routing more traffic through a VPN does not remove attacker software or keys. A securely managed remote-access VPN can reduce the need to expose administration directly, but that is a network-design measure—not a substitute for supported devices and incident recovery.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.