Hackers Broke Into Old NAS Boxes and Camera Recorders to Quietly Sell Their Owners' Internet Connections

Somebody has been breaking into forgotten storage boxes and video recorders around the world, and they are not after the files. They want the internet connection. Threat intelligence firm GreyNoise found a proxyjacking campaign that has compromised at least 143 devices in 34 countries and quietly rents out their bandwidth through a commercial residential proxy network.

The tool doing the earning is perfectly legal. Pawns.app is a bandwidth-sharing app that pays people for letting other users' traffic flow through their connection. The attacker installed it on hijacked devices without the owners' consent, and the payouts went to an account the attacker controls. Spread across enough machines, those small payments add up.

How they got in

None of the entry points were new. The attacker used CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2025-31324 in SAP NetWeaver Visual Composer, and, remarkably, Log4Shell (CVE-2021-44228) in Ubiquiti UniFi Video recorders. Hikvision and Dahua DVR and NVR devices were also targeted, though GreyNoise did not say which flaws were used against them.

Pawns.app's command-line versions make the scheme easy. They accept account credentials and device details at runtime, so whoever installs the software can tie another person's bandwidth to their own account. IPRoyal lists Pawns.app as a direct partner for sourcing residential proxies. There is no indication either company was involved in the campaign; the abuse is someone else deploying their software without permission.

On some devices, the attacker also set up SSH key authentication as a spare way back in.

Why it matters beyond the victims

The campaign surfaced through a different investigation entirely. During a live GreyNoise product demo, an organization noticed IP addresses flagged as malicious in its Microsoft Entra ID sign-in logs, GBHackers reported. The addresses looked residential and sat in the same regions as its normal users. They turned out to belong to residential proxy networks, and the giveaway was several different users signing in through the same home address. Digging further confirmed a serious intrusion.

GreyNoise kept the details of that intrusion private and says the evidence does not show it was carried out by the same operator running the proxyjacking scheme. It did not name the attacker or the victim organization.

What the episode shows is why residential proxies are so valuable to criminals. Traffic coming out of a home connection looks like an ordinary customer, which blunts defenses built on IP reputation or unusual geography. Even legitimate proxy networks can route shady traffic through volunteers, which can get those people's addresses blocked or linked to crimes. The FBI has previously warned that such networks are used for large-scale credential stuffing.

Not the first time

Microsoft has documented Midnight Blizzard using spread-out residential proxies to hide password spraying. In 2023, Sysdig described attackers using Log4j to install proxyware instead of crypto miners, because selling bandwidth uses far less CPU than mining and slips past monitoring that watches for resource spikes. Network edge gear keeps turning up as the soft spot, as in the PEERSTITCH campaign that compromised more than 500 FortiGate firewalls through FortiManager.

GreyNoise offers a free lookup, with an account, that checks whether an IP belongs to a known legitimate or gray proxy service. The rest of the defense is unglamorous: update or retire old NAS boxes and recorders, use strong credentials, and keep them off the open internet where possible.

That is the uncomfortable part. Every flaw in this campaign was public well before these break-ins, and Log4Shell has been known since 2021. The devices were not cracked by anything clever. They were simply left running and forgotten.

Some offers on this page may be paid placements or contain affiliate links.