Critical D-Link, Ubiquiti, SAP Flaws Exploited for Proxy Network Hijacks

Key Takeaways

• A cybercrime group, “skynox7,” has compromised at least 143 devices across 34 countries.
• The attackers exploited critical vulnerabilities in D-Link, Ubiquiti, and SAP products.
• Compromised devices are being used as residential proxy nodes by installing Pawns.app software without consent, a practice known as “proxyjacking.”
• The exploited flaws include CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, and CVE-2025-31324.
• Organizations should immediately patch affected systems and implement robust network segmentation and access controls.

A recent cybercrime operation has successfully hijacked a minimum of 143 devices spanning 34 nations, leveraging critical vulnerabilities found in D-Link, Ubiquiti, and SAP products. The objective of this campaign is to transform these compromised systems into nodes within a residential proxy network.

The attackers installed specialized proxy software, specifically Pawns.app, onto the infiltrated devices. This malicious deployment converts the victims’ internet connections into residential proxy nodes, allowing the threat actor to route illicit internet traffic through legitimate, real IP addresses belonging to unsuspecting users. This technique significantly complicates traceability and helps the malicious traffic blend in with ordinary user activity, as detailed in a comprehensive report.

GreyNoise researchers identified this ongoing campaign and have attributed it to an actor operating under the moniker “skynox7.” The group exploited pre-existing, known vulnerabilities in network-attached storage (NAS) devices, video surveillance systems, and enterprise software to gain unauthorized access. Following the initial breach, they deployed proxy software that, while capable of legitimate use when installed with consent, is being utilized without permission in this context.

GreyNoise emphasizes that the binaries associated with this campaign are not inherently malicious. The critical concern arises from their unauthorized installation and subsequent use, which constitutes a breach of trust and security. This campaign underscores a growing trend where exposed edge devices are weaponized to obscure the true origin of cybercriminal activities. Unlike traditional proxy servers, a residential proxy funnels traffic through a device connected to a genuine home or business network, making it appear as legitimate local traffic.

The advantage for attackers is clear: an IP address matching a user’s typical location can bypass geographical alerts that might otherwise flag suspicious login attempts. GreyNoise warns that the use of residential proxies can severely impede efforts to detect and investigate unusual sign-ins and other online anomalies.

Hackers Exploit D-Link, Ubiquiti, and SAP Flaws

According to GreyNoise, the “skynox7” actor exploited four distinct vulnerabilities across three different product categories. The targeted technologies include D-Link ShareCenter NAS devices, Ubiquiti UniFi Video network video recorders (NVRs), and SAP NetWeaver Visual Composer.

The specific vulnerabilities exploited are CVE-2024-3272 and CVE-2024-3273 affecting D-Link devices, <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/de519330-8a40-4ff5-ad55-bdb800e73d4c/Hackers-Exploit-D-Link-Ubiquiti-and-SAP-Flaws-to-Hijack-Devices-for-Proxy-Networks.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Checksum-Mode=ENABLED&X-Amz-Credential=ASIA2F3EMEYEQ4JA6QEQ%2F20261016%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261016T073351Z&X-Amz-Expires=2966&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEBgaCXVzLWVhc3QtMSJHMEUCIEH%2BFoe%2FxlEAnNOMTjtWhBG%2BSlV%2FjNHN%2FRdW8AVHZ9VQAiEAkeC%2BJGp%2BR%2FfKDdvQEZgU0rinSbtMztR7e2c6vlxj2PAqiQUI4P%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDJ5w95SXIX1PgO0B2CrdBFnDRI7fLXR2eK4%2FgduyG1Fucvur7ufr8AaZVMqGNFzigmxR3ID%2FxehT7SXQArC2MqurKl%2Fkw%2BYBLZVdGgeqqjtaJKeKG2YvnY5Jx5KZG4Rxt3Z47Liwc8%2FcIPo30nudyVVUdc5%2BSmjFfZA%2BtNgFXsqVJ2%2BMoqDVPDIrRYvakNY0P7PPrd8Huvj6m03HmQvoU8hZIpQ5esnKKqytQKN3jUMimsBK27%2B3Vj9WT7%2FzW78PQHfgdSOUSh4rc0aWn9D5fv8ZheeafqNyhnC1nBuUyMfprOkDmzK1jBDQ9%2FypDolyrw%2FQeN8bifigRBo%2F0M%2F%2Fv7NTMoniiJOuFEMRkMh3TffWJDpTMd4wqJa7EpQc76%2FF5Yb%2BWeW%2BuVUr%2F7iupHNVgdk7WBdfdIu%2FBYvJX6iZHDhAD5nCm2O3XXfFHomusN7dqmEjwdEd4%2FNMZkWhLBeQiBmWEYGd6meqpokz4jzfADG%2F1lB6HAekWwyApVX8JaR3dPdtKfMbKe91RKb7hkdwkOBlRM6xGHz6DItlodvbrG1BBCD6uOfZjQ5rwCp8Nplb3STxF3T%2B03Pa1XbDmLUqiSU%2FNpfIaSZUrR9Xb0NHKFAn8dAYVJNhqZHsgD9AB1Tct%2B5cgngSy0MXs%2BONQ4wBc%2FJI274Uk%2BkvEjrcV7Pl%2FP%2BhbwQCKU7VWDOWe7CFGvPoPkq9WipTSIa3CBH8SLuwZac2bC72xetuF

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.