Proxyware crew hijacks D-Link, Ubiquiti, SAP via old CVEs

Threat intelligence firm GreyNoise says a single operator has quietly enrolled at least 143 compromised devices across 34 countries into Pawns.app, a legitimate bandwidth-sharing application run by proxy provider IPRoyal — without the device owners' consent, turning each box into a residential-proxy exit node someone else pays to route traffic through. The primary write-up is GreyNoise's own research, Your IP Address Might Be Someone Else's Problem; it was reported by Bill Toulas at BleepingComputer.

What the bug does

Nothing new — that is the point. The operator is spraying known vulnerabilities at internet-exposed appliances and NAS boxes, none of them fresh:

• CVE-2024-3272 and CVE-2024-3273 — D-Link ShareCenter NAS. These are end-of-life devices; D-Link will not patch them.
• CVE-2021-44228 — Log4Shell, against Ubiquiti UniFi Video NVR.
• CVE-2025-31324 — SAP NetWeaver Visual Composer, a flaw already exploited in the wild and carried in CISA's KEV catalog.

GreyNoise also observed the same actor targeting Hikvision and Dahua DVR/NVR devices, though it did not specify the flaws used there.

How they keep access

After exploitation, the operator installs the Pawns.app client and, according to GreyNoise, sometimes configures SSH key authentication as a backup access method — so revoking the proxy client alone does not necessarily evict the intruder. Pawns.app pays account holders for passing third-party traffic; running it on scores of other people's devices is the monetization.

Exploitation status

GreyNoise says it found the activity while investigating suspicious traffic at an unnamed organization. The 143-device figure is what GreyNoise observed, not a ceiling. No threat actor has been named, and GreyNoise did not publish file hashes or IPs in the summarized version of the report.

What to do today

1. Retire end-of-life D-Link ShareCenter NAS exploited by CVE-2024-3272/3273. There is no fix; the only remediation is replacement and removal from the internet.
2. Patch Log4Shell (CVE-2021-44228) anywhere it still lingers, including Ubiquiti UniFi Video NVR appliances — four years on, this is still landing.
3. Patch SAP NetWeaver Visual Composer (CVE-2025-31324) immediately if not already done; it is actively exploited and in CISA KEV.
4. Hunt for the Pawns.app client and unexpected outbound proxy connections from appliances and NAS devices, which have no business initiating arbitrary outbound traffic.
5. Audit authorized_keys on exposed Linux-based devices for SSH keys you did not add, and lock down egress at the firewall.

Context

This is the residential-proxy economy eating the long tail of unpatched edge gear. Providers advertise "ethically sourced" IPs; researchers keep finding the supply built partly on compromised routers, NAS boxes, and cameras. The devices here were reachable because they were either abandoned by their vendor (the D-Link NAS line) or left running a 2021 or 2025 bug. The operator did not need a zero-day — just a scanner and a list of things nobody patched.