Scan 34 countries for Pawns.app on D-Link, SAP, Hikvision, Dahua gear to stop bandwidth resale

Home and business users who own D-Link NAS devices, SAP NetWeaver systems, Hikvision or Dahua recorders may have had their internet connections hijacked. Cybersecurity firm GreyNoise reported that attackers installed a bandwidth-sharing application on these devices without consent. The stolen internet traffic was then sold through a commercial proxy network, potentially exposing owners to legal risks if illicit activity flows through their IP addresses.

Whose data or accounts are involved?

The incident involves the network connections and IP addresses of device owners, not personal files or passwords directly. GreyNoise identified at least 143 compromised devices worldwide across 34 countries. The primary targets were internet-facing hardware including D-Link ShareCenter NAS units and SAP NetWeaver Visual Composer systems. Researchers also observed activity targeting Hikvision and Dahua digital video recorders, though specific flaws used on those cameras remain unconfirmed.

How did the attackers gain access?

The threat actors exploited known security flaws to breach the devices and install Pawns.app, a legitimate application that rewards users for sharing bandwidth. According to GreyNoise, the campaign used CVE-2024-3272 and CVE-2024-3273 to compromise D-Link NAS devices. For SAP systems, attackers leveraged CVE-2025-31324. The researchers noted that in some instances, the intruders also configured SSH key authentication as a backup method to maintain persistent access to the hijacked systems.

What are the risks to the owner?

Using a compromised device as a proxy node can lead to serious consequences for the owner. GreyNoise warned that legitimate proxy networks may route suspicious traffic through volunteer-operated nodes due to insufficient oversight. This can result in the user’s IP address being blocked by online services or being flagged for involvement in illegal activities. The FBI has previously warned that such networks are often used to carry out large-scale credential stuffing attacks against various online platforms.

What is the current status of fixes?

The source material does not state whether a patch or fix has been released by the manufacturers. GreyNoise advises that keeping NAS devices, video recorders and other internet-facing systems updated significantly reduces the risk of compromise. Users should also employ strong credentials and secure configurations. Restricting network access to these devices is a recommended step to limit exposure, regardless of whether a specific vendor update is available.

What affected people can do

Owners of the affected hardware should verify whether their devices are currently part of a proxy network. GreyNoise offers a free service to check if an IP address is listed in known proxy databases. Teams usually review device logs for unexpected installations of bandwidth-sharing applications. Users should also check for unusual network traffic spikes. If a device is found to be compromised, it should be isolated from the internet immediately. Owners must reset all administrator passwords and ensure firmware is current. Beware of follow-up scams claiming to remove the malware; legitimate vendors will never ask for remote access via chat.

What to do and how to stay safe: D-Link

• Check your IP address against proxy lists using the free GreyNoise service to see if your connection is being shared.
• Update firmware on all D-Link, SAP, Hikvision and Dahua devices to the latest available versions to patch known vulnerabilities.
• Change default administrator passwords to strong, unique credentials and disable any unnecessary remote access features like SSH if not required.
• Monitor network traffic for unusual spikes or connections to unknown servers that could indicate ongoing data exfiltration or proxy activity.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific devices were targeted in this proxyjacking campaign?

The campaign targeted D-Link ShareCenter NAS devices, SAP NetWeaver Visual Composer systems, and Hikvision and Dahua DVR/NVR devices.

How can I tell if my device has been compromised?

You can check if your IP address is part of a known proxy service using the free tool provided by threat intelligence company GreyNoise.

What vulnerabilities did the attackers exploit?

Attackers used CVE-2024-3272 and CVE-2024-3273 on D-Link devices, and CVE-2025-31324 on SAP NetWeaver Visual Composer systems.