Loading threat actor…
skynox7 is a financially motivated threat actor associated with a proxyjacking campaign that compromised at least 143 devices across 34 countries. The actor exploits internet-facing network-attached storage devices, network video recorders, and enterprise applications, then installs Pawns.app without the owners’ consent. This legitimate bandwidth-sharing software enrolls compromised systems in a commercial residential proxy network, allowing the actor to monetize victims’ internet connections and route third-party traffic through their public IP addresses. The campaign targeted D-Link ShareCenter devices through CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video network video recorders through exploitation associated with CVE-2021-44228, and SAP NetWeaver Visual Composer through CVE-2025-31324. On some compromised systems, skynox7 configured SSH key authentication as a backup access mechanism that could remain usable after the initial vulnerability was patched.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
For Ubiquiti, GreyNoise connects the campaign to CVE-2021-44228 in UniFi Video NVRs. The source does not provide device-level details or a count for each product.
The reported flaws were CVE-2024-3272 and CVE-2024-3273 in D-Link devices, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer.
The reported flaws were CVE-2024-3272 and CVE-2024-3273 in D-Link devices, CVE-2021-44228 in Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer.
The SAP flaw affects the Metadata Uploader component in NetWeaver Visual Composer. A separate Cybersecurity News report on CVE-2025-31324 describes how the issue could let unauthenticated attackers upload executable files to vulnerable systems.
9 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named in connection with a proxyjacking campaign that turned edge devices into residential proxies, affecting 143 devices across 34 unspecified countries. The excerpt provides no further attribution or technical details.
Conducts proxyjacking by exploiting internet-facing devices and installing Pawns.app without owners’ consent to monetize their bandwidth through a commercial residential proxy network. The reported campaign compromised at least 143 devices across 34 unspecified countries, affecting D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVRs and SAP NetWeaver Visual Composer. The actor also appeared to target Hikvision and Dahua devices, although successful compromise was not confirmed.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.