Proxyjacking Campaign Hijacks NAS Servers and Video Recorders to Resell Owners' Bandwidth

At least 143 devices in 34 countries were hijacked and used to resell other people’s internet bandwidth for profit. GreyNoise detailed the campaign on October 15, and BleepingComputer also reported on the findings. The attacker installed Pawns.app, a legitimate application, without the device owners’ consent.

How the campaign worked

Pawns.app lets users share their internet connection voluntarily in exchange for payment. In these attacks, however, the app was installed on other people’s devices after they had been compromised. As a result, traffic from users of the proxy network could exit to the internet from the victim’s IP address, and the attacker’s own account was credited for the bandwidth shared.

According to GreyNoise, the attacker exploited known vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR and SAP NetWeaver Visual Composer. The researchers also saw attacks against Hikvision and Dahua recorders, but did not identify which flaws were used against those devices. In some cases, the attacker also added an SSH key to keep a second way back in.

What is new is the disclosure of this specific campaign and its scale. The report does not mean that every product from these vendors is vulnerable, or that every Pawns.app installation is malicious.

Why it matters for businesses

A file server or surveillance video recorder can keep working normally while someone else is using its connection. A device that hasn’t failed is not proof that it is secure. Devices exposed directly to the internet need especially close attention.

GreyNoise also highlights a detection problem: a residential IP address and a login location that looks legitimate do not prove a session is genuine. Proxy networks can make it harder to tell a real user from an attacker. For administrators, this means also looking at device characteristics and how the authentication actually happened.

What to check now

• Identify which NAS servers, video recorders and admin panels are reachable from the internet, and remove any access that isn’t needed.
• Check whether updates are available and whether older hardware can still be maintained securely.
• Look for unauthorized Pawns.app processes, unfamiliar SSH keys and unusual outbound connections.
• If you find changes, preserve the logs, isolate the device and determine how the attacker first got in.
• When analyzing logins, compare device and session identifiers rather than relying only on where the IP address appears to be.

SecurHUB’s take

Video recorders and NAS servers should be monitored as closely as the rest of a company’s infrastructure. Security audits help assess device exposure, access configuration and how updates are managed.

Sources: GreyNoise, BleepingComputer