Loading story…
An unidentified attacker compromised at least 143 devices across 34 countries and installed the legitimate bandwidth-sharing application Pawns.app without owners’ consent, monetizing victims’ internet connections. GreyNoise reported exploitation of vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVR systems, and SAP NetWeaver Visual Composer; Hikvision and Dahua recording devices were also targeted. In some cases, the attacker added SSH keys to maintain backup access.
The campaign exposes device owners to unwanted proxy traffic, IP address blocking, and potential allegations of illegal activity conducted through their connections. GreyNoise’s investigation also highlighted a separate intrusion at an unnamed organization, confirmed after investigators noticed multiple users authenticating through the same residential proxy IP address. Defenders should scrutinize shared residential proxy addresses in authentication logs, investigate behavioral anomalies rather than relying on geolocation alone, and check affected systems for unauthorized bandwidth-sharing software and SSH keys.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
GreyNoise identified 209.99.190.80 as an exploitation IP address and skynox7@proton.me as the attacker's Pawns payout account, and published seven SHA-256 hashes for associated Pawns.app binaries. It cautioned that the binaries were not necessarily malware; their unauthorized installation constituted the malicious activity.
The attacker configured some compromised devices to accept attacker-controlled SSH keys, providing a backup access mechanism.
An unidentified attacker exploited D-Link ShareCenter NAS vulnerabilities CVE-2024-3272 and CVE-2024-3273, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer, installing Pawns.app without authorization to monetize victims' bandwidth. The campaign compromised at least 143 devices across 34 countries and also targeted Hikvision and Dahua recorders, although successful compromises of those products were not confirmed.
The organization discovered multiple users authenticating through the same residential proxy IP address and subsequently confirmed a serious intrusion. GreyNoise withheld further details of the investigation.
During a product demonstration, GreyNoise identified malicious-labeled IP addresses in an unnamed organization's Entra ID sign-in logs. The addresses were residential proxies in locations consistent with the organization and its users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nokia Deepfield researchers reported that the **Jackskid** DDoS botnet, the **peer4you-mirai** hybrid malware, and the **trees4sale** residential proxy service are linked to a single operator that abuses **UPnP Internet Gateway Device** port mapping to expose infected residential devices directly to the internet. Instead of routing traffic through outbound tunnels, the malware opens about **165 external router ports** marked **"RELAY"**, converting compromised home devices into proxy exits. The report ties the operations together through shared relay code, a byte-identical `RCtea` configuration key, overlapping infrastructure, and cryptocurrency wallets funded by the same upstream source. The research says **peer4you-mirai** connects the DDoS and proxy activity, while newer Jackskid variants either deploy the relay as a second Android payload or embed it directly into Linux bot binaries. In addition to DDoS and proxy services, the operator reportedly uses compromised residential devices as a rotating **C2 relay mesh** populated from a `/nodes` director. The technique builds on the long-observed **UPnProxy** abuse pattern, but the newer campaign operationalizes it at scale for botnet control and commercial proxying. Defenders were urged to watch for **SSDP discovery**, SOAP `AddPortMapping` requests, and NAT entries whose description is **"RELAY"**, which the researchers described as strong indicators of compromise.
Aug 14, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jul 9, 2026