By Hamza Faisal
A quiet hacking campaign has been turning routers, storage boxes, and video recorders into money-making machines for cybercriminals — without their owners ever knowing. Threat intelligence firm GreyNoise says an attacker it tracks as "skynox7" has hijacked at least 143 devices across 34 countries, silently installing a bandwidth-sharing app called Pawns.app and selling victims' internet connections as paid residential proxies.
Residential proxies are prized by criminals because traffic routed through a real home or office connection looks ordinary. Logins from such an address rarely trigger location-based fraud alerts, which makes the stolen bandwidth ideal for hiding spam, credential stuffing, and other anonymous activity. The victims get the bill in bandwidth and electricity — and potentially awkward questions when their IP shows up in someone else's logs.
How the break-ins worked
GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and found the attacker exploiting known — but unpatched — vulnerabilities in widely deployed edge devices. The list reads like a greatest-hits of neglected hardware: CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, the infamous Log4Shell flaw (CVE-2021-44228) in Ubiquiti UniFi Video NVR systems, and CVE-2025-31324 in SAP NetWeaver Visual Composer.
Researchers also observed the attacker targeting Hikvision and Dahua DVR and NVR surveillance systems, though the exact vulnerabilities used against those were not disclosed. In some compromises, the intruder went further than proxyware — configuring SSH key authentication on the device as a backup entry point, so it could get back in even after the owner patched the original hole.
Stealthy by design
What makes this campaign hard to catch is that Pawns.app is a legitimate commercial service — people normally install it voluntarily to earn money by sharing their connection. Enrolling dozens of hijacked devices under a single attacker-controlled account likely multiplied the payouts, turning the victims' hardware into a revenue stream.
GreyNoise warns the proxy binaries themselves are not automatically malware — the crime is the installation without consent. Because the traffic comes from a commercial, trusted service, it can sail past traditional security alerts that look for known-malicious tools. The FBI has previously warned that residential proxies are routinely abused in credential-stuffing attacks, and victims here risk having their IPs blacklisted or tied to abuse they never committed.
What to do about it
The defense is unglamorous but effective: keep internet-facing devices updated. GreyNoise and security researchers urge owners of NAS devices, network video recorders, and other edge hardware to install the latest firmware, use strong unique credentials, and audit SSH keys and startup services for anything unfamiliar. Devices that can no longer receive security updates — like some older D-Link models — should not be exposed to the internet at all.
The skynox7 campaign is a reminder that the soft underbelly of the internet is not in the cloud — it is in the plastic box blinking on your shelf. Hamza Faisal covers cybersecurity for Paktechstan.com.
