Tech Infrastructure

Proxyjacking: Edge Devices Hijacked to Resell Bandwidth

By Nattapong Sukkasem · Published 2026-10-17 · Updated 2026-10-21.

Most intrusions take something you can name. This one takes something most organisations never wrote down: the reputation of the IP address their traffic leaves from. The campaign GreyNoise described on 15 October turns neglected tech infrastructure — a storage box in a cupboard, a video recorder nobody has logged into since installation — into billable exit nodes on a residential proxy network, paying the operator by the gigabyte for traffic attributed to you.

What GreyNoise found

One qualifier deserves carrying at full strength: the published hashes are not necessarily malware. Pawns.app is a real product with paying users; what makes these installations an incident is consent, not code. GreyNoise also says it has not shown either proxy provider directed the campaign.

A five-year-old CVE list, and no zero-day vulnerability

Look at the dates. Log4Shell was disclosed in December 2021. The D-Link flaws were published in April 2024 by the researcher netsecfish, who found over 92,000 affected NAS devices reachable from the internet; D-Link's answer was that the DNS-320L, DNS-325, DNS-327L and DNS-340L are end-of-life, will not be patched, and should be replaced. The SAP flaw, from 2025, is the youngest.

So the operator needed no zero-day vulnerability and no exploit development. It needed a list of devices whose vendors have already stopped writing fixes. That is the uncomfortable property of an end-of-life advisory: it converts a vulnerability from a patching problem into a permanent feature of the internet.

Edge hardware is where this accumulates, because this part of the tech infrastructure estate is bought once and owned by nobody afterwards. A NAS has an asset tag and no owner; an NVR is a facilities purchase with an Ethernet port. Neither appears in the patch cycle that governs the servers, and neither complains when it is quietly working for someone else.

The payload is legitimate software, which breaks your detection

Nearly every control in a modern IT security stack assumes the payload is hostile. Proxyware is not. It is signed, sold by a company with a support page, and does exactly what it claims. GreyNoise notes the command-line builds accept a username, password and device identifier at runtime — convenient for a legitimate operator running a fleet, and equally convenient for someone running a fleet they do not own.

The behavioural tells are weak too. Cryptomining pins a CPU and gets caught by resource monitoring; proxyware idles, waiting to relay somebody else's session, and its traffic is TLS to a commercial endpoint. Nothing there trips a rule written for malware, which is why GreyNoise's advice points at identity instead: several corporate accounts signing in from one residential address, and mismatched device, session and User-Agent attributes behind a login whose geolocation looks plausible.

Why your address is the asset

Residential proxy networks pay for trust. An exit node is worth money only while its IP is clean — not blocklisted, not flagged, not obviously a datacentre. That is what a small business line or branch office connection provides, and why the pool mixes a German ERP server with a NAS in a spare room.

The loss is therefore reputational before it is technical. Traffic you did not generate leaves your address: scraping, account testing, whatever the renting customer is doing that hour. Unlike a DDoS attack, which converts stolen bandwidth into noise, proxyjacking converts it into revenue, so there is every incentive to keep the host healthy and quiet. You find out when a partner's fraud system starts challenging your staff, or when a SaaS provider rate-limits your office.

There is a cloud security dimension too: an exposed NetWeaver instance in a hosted estate is reachable from everywhere, inventoried by nobody, and bills its own bandwidth to you.

The DNS signal, and the latency one

A NAS is one of the few hosts with a genuinely boring resolution profile: its vendor's update endpoint, maybe a time server, maybe a dynamic DNS name — a handful of lookups a day, the same handful every day. That makes it one of the cheapest baselines available and one almost nobody keeps. Proxyware changes that profile permanently, because it must maintain a relationship with its broker.

Two caveats keep this honest. The lookups only cross a resolver you control if the device uses one — a box configured for DNS over HTTPS straight to a public service resolves past your logging entirely, which argues for forcing resolution to your own servers on appliance segments, not for distrusting encrypted DNS. And a resolution log tells you a relationship exists, not what is being relayed.

The second signal is cruder and more immediate: the uplink. A line quietly carrying somebody else's sessions has less headroom than your capacity planning assumes, and the first thing to degrade on a saturated link is small, latency-sensitive traffic — which means name resolution. Rising, erratic DNS resolution latency with no configuration change is a congestion symptom worth chasing, and a resolver benchmark run from the affected site is a faster network diagnostic tool than a packet capture. We made the same point about the Philippines subsea cable cuts this month: lost capacity presents as congestion, not as a network outage you can open a ticket against.

Seven checks worth running this week

1. Inventory what has an IP and no owner: NAS, NVR, print controllers, building management. The campaign's target list describes that category, not a vendor.
2. Treat end-of-life as exploited. If the vendor has stopped patching, the fix is replacement or isolation — CVE-2024-3272 has been unpatchable for eighteen months.
3. Audit SSH authorized_keys on appliances. The proxy app is the payload; the key is the way back in. Removing one without the other achieves nothing.
4. Hunt in the identity logs. Several accounts from one residential IP is the signal that exposed this campaign. Geolocation alone will not do it.
5. Baseline resolution per device. Record what each appliance normally asks for and alert when the shape changes — the only durable record of what an opaque box talks to.
6. Check your egress reputation from outside. Confirm which address each site actually leaves from with a public IP address check, then look it up in the proxy and abuse databases your partners use.
7. Measure the uplink you think you have. Benchmark resolver response times from each site on a schedule, so congestion shows up as a trend rather than a complaint.

Industry impact

The economics make this persistent. A ransomware operator must be noticed to be paid; a proxyjacker is paid for uptime, so the correct strategy is to change nothing a user would notice. Campaigns built that way run for years, and 143 devices is what one researcher found while looking at something else.

It also redraws the boundary of what counts as tech infrastructure worth defending. The industry has spent a decade learning to protect data and compute. This campaign monetises neither. It monetises position — the fact that your packets come from an address people trust — and position is not something a backup restores.

The conclusion for most teams is unglamorous. There is no advisory to action and no patch to deploy, because the patches either shipped years ago or will never ship at all. What there is, is a list of tech infrastructure nobody owns, a protocol that records what it talks to, and a link whose spare capacity is now a measurable asset. Finding the first, logging the second and watching the third is a week's work — and the only thing that catches this class of intrusion before a third party tells you about it.

Sources

• GreyNoise — Proxyjacking edge devices into residential proxies
• BleepingComputer — Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
• GBHackers — New proxyjacking campaign exploits network device flaws
• TechNadu — skynox7 proxyjacking campaign hijacks 140+ edge devices
• Help Net Security — 92,000+ internet-facing D-Link NAS devices accessible via backdoor account

Related articles

• Entra ID CVSS 10.0 RCE Flaw CVE-2026-69836 Explained
• Cloudflare Cross-Tenant Disk Leak
• Cisco Secure FMC Flaw Exploited to Deploy Qilin Ransomware

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: BleepingComputer — Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth (2026-10-15).