A cybercrime operation has quietly turned at least 143 internet-connected devices in 34 countries into unwitting proxy nodes, according to new research from GreyNoise. Rather than deploying ransomware or stealing data directly, the attackers behind the campaign installed commercial proxy software on compromised devices, monetizing victims’ internet connections while using their real-world IP addresses to mask other activity.

The technique, known as proxyjacking, differs from a conventional proxy server in an important way: because traffic is routed through a genuine residential or business connection, it can carry the credibility of an ordinary user’s location and network reputation. That makes malicious logins or scraping traffic routed through a hijacked device far harder to flag using geography or IP reputation alone.

Four Old Vulnerabilities, One Coordinated Campaign

GreyNoise attributes the activity to an actor it tracks as “skynox7,” who relied on four previously disclosed vulnerabilities spanning three very different product categories:

• D-Link ShareCenter NAS devices — via CVE-2024-3272 and CVE-2024-3273
• Ubiquiti UniFi Video network video recorders — via CVE-2021-44228, the long-running Log4Shell flaw
• SAP NetWeaver Visual Composer — via CVE-2025-31324, a flaw in the Metadata Uploader component that allows unauthenticated attackers to upload executable files

None of these flaws are new, which is part of what makes the campaign notable: it shows attackers continuing to find value in exposed, unpatched edge devices and enterprise software long after fixes became available. The inclusion of an enterprise-grade SAP deployment alongside consumer NAS boxes and small-business video recorders also indicates the operator wasn’t selective about device class, only about whether a known, exploitable flaw was present and internet-facing.

From Exploit to Monetized Proxy Node

After gaining access, the attacker installed software associated with Pawns.app, a commercial residential-proxy platform that in legitimate use lets device owners knowingly share bandwidth for payment. GreyNoise stresses that the binaries themselves aren’t automatically malicious — the problem is that they were installed and operated without the device owners’ knowledge or consent, turning a legitimate monetization tool into an unauthorized surveillance-evasion layer for the attacker.

In several cases, the actor also configured SSH key-based authentication as a backup access method, a detail that matters for incident response: even after the original vulnerability is patched, a hardcoded SSH key can let the attacker walk back in through a separate door. GreyNoise’s researchers say the group appeared to probe other DVR and NVR brands, including Hikvision and Dahua equipment, though the report does not confirm those attempts resulted in successful compromises.

Why Residential Proxies Complicate Detection

The investigation that uncovered the campaign reportedly began after security analysts noticed multiple unrelated user accounts authenticating from the same residential IP address — an anomaly that doesn’t fit normal usage patterns and prompted a deeper look. That single detail illustrates the core challenge residential proxies pose for defenders: a login from a “trusted-looking” home IP address can still be fraudulent, and location-based risk scoring alone won’t catch it.

GreyNoise recommends that security teams move beyond geography when evaluating sign-in risk, incorporating signals such as device fingerprints, session identifiers, and User-Agent strings that are harder for a proxy operator to spoof convincingly.

What Organizations Should Do Now

• Inventory internet-facing NAS devices, network video recorders, and SAP systems, and check them against the specific CVEs named above.
• Apply vendor patches immediately; where immediate patching isn’t possible, restrict access to management interfaces and the SAP Metadata Uploader endpoint specifically.
• Review authentication logs for repeated or unusual sign-ins from the same residential IP address, especially across accounts that shouldn’t normally share a network.
• Audit SSH authorized-key files on previously exposed devices, since attackers may have added persistent backdoor access before a patch was applied.

The campaign is a reminder that unpatched, internet-exposed hardware doesn’t need to be headline-grabbing to be valuable to criminals — a years-old NAS vulnerability or an unpatched video recorder can still generate ongoing revenue for an attacker long after most defenders have stopped thinking about it as a live threat.