Hackers are breaking into internet-connected devices and secretly turning them into nodes in a residential proxy network that sells the victims’ bandwidth. GreyNoise says the campaign hit at least 143 devices in 34 countries and abused CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer; Hikvision and Dahua DVR/NVR devices were also targeted. In some cases the attackers added SSH keys for persistent remote access.
Why it matters: Affected organizations and users may unknowingly have their internet connections used for other people’s traffic, which can lead to abuse complaints, blocks, and follow-on compromise. Owners of exposed D-Link, Ubiquiti, SAP, Hikvision, and Dahua systems should patch or isolate them immediately and check for unauthorized software or SSH keys.
Bill Toulas
2026.10.15
100% relevant
This article establishes a distinct proxyjacking campaign with a specific monetization method, affected vendors, and exploited CVEs, rather than updating an existing tracked story.
← Back to all stories