Somebody broke into at least 143 internet-facing devices in 34 countries, not to steal data from them but to rent out their internet connections. GreyNoise says an actor tied to a proxy payout account named skynox7 exploited known flaws in network storage boxes, video recorders and SAP servers, then installed bandwidth-sharing software that sells each victim's connection to paying proxy customers.
The practice is called proxyjacking, and it matters well beyond the owners of the hijacked boxes. Every compromised device becomes a residential IP address that anyone on the proxy network can route traffic through, which lets an intruder appear to log in from an ordinary home connection in a plausible location.
A product demo that turned into incident response
GreyNoise explains in its report that the research began during a live product demonstration. The customer spotted GreyNoise-labelled malicious IP addresses in its Entra ID sign-in logs. They looked residential and geographically sensible, so the logins could have been legitimate. The giveaway was that multiple users were authenticating from the same residential IP address, and the organization went on to confirm a serious intrusion. GreyNoise is not publishing details of that case, but it prompted follow-up research into how commercial residential proxy networks are being abused.
Known bugs, a new revenue stream
The skynox7 actor gained access through publicly known vulnerabilities:
- D-Link ShareCenter NAS: CVE-2024-3272 and CVE-2024-3273
- Ubiquiti UniFi Video NVR: CVE-2021-44228 (Log4Shell)
- SAP NetWeaver Visual Composer: CVE-2025-31324
GreyNoise also saw the actor go after other DVR and NVR brands, including Hikvision and Dahua, and in some cases configure victim devices to accept its own SSH key as a backup way back in. The software it installed was Pawns.app, an "earn on your internet" program that pays people to share their bandwidth and that GreyNoise describes as a direct partner of the proxy provider IPRoyal. Its command-line versions accept a username, password and device details at runtime, which GreyNoise notes makes them easy to install on a device the installer does not own. GreyNoise is careful to say these binaries are not necessarily malware unless installed without consent.
The campaign fits a wider pattern of cheap edge hardware being turned into anonymising infrastructure, such as the Linux backdoor that turns hacked routers into proxy nodes.
Flag shared residential IPs in sign-in logs
- Patch the D-Link, Ubiquiti and SAP systems listed above, or take them off the internet.
- Flag residential proxy IP addresses in authentication logs, and treat several enterprise users signing in from the same residential IP as a priority alert.
- Look beyond geolocation: mismatched device identifiers, session identifiers or User-Agent strings are stronger signals.
- Tell users that free bandwidth-sharing apps on personal devices carry real risk, and keep those devices patched.
Indicators (defanged): exploitation source 209[.]99[.]190[.]80; Pawns payout account skynox7[at]proton[.]me; Pawns.app SHA-256 samples including e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd, fdc18f4287c1c6a285c664d3ce0f17d3479bc246bc6c163eb90b1a84adb453a7 and 4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7. GreyNoise's report lists seven hashes in total.
GreyNoise says it is passing details to government and law enforcement agencies. For defenders, the takeaway is simpler: a login from a normal-looking home connection nearby is no longer reassuring on its own.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.