A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. The devices affected include D-Link and Ubiquiti hardware, according to the report.
What happened
Instead of encrypting data or stealing files, the operator turned compromised devices into a source of income. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners' consent. The owners keep paying for the connection, and someone else sells access to it.
This matters for two reasons. The first is cost and performance, since a hijacked connection carries traffic the owner never asked for. The second is attribution, because traffic from a residential proxy network appears to come from the victim's address.
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network.
How it was done
The campaign used known flaws in internet-facing hardware. Among them were CVE-2024-3272CVSS 9.8 CRITICAL / Published 2024-04-04A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler.View on NVD and CVE-2024-3273CVSS 9.8 CRITICAL / Published 2024-04-04A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler.View on NVD in D-Link ShareCenter NAS. These are the kinds of appliances that sit at the edge of a network, often outside the regular patching cycle, and often forgotten once they are installed.
Access was also made durable. GreyNoise says that, in some cases, the attackers configured SSH key authentication as a backup access method. That means removing the bandwidth-sharing application alone would not necessarily end the intrusion.
What to check
If you run network appliances or storage devices at the edge, a short review is worth the time.
- Inventory every D-Link and Ubiquiti device reachable from the internet, including hardware nobody currently owns in your asset list.
- Confirm whether CVE-2024-3272CVSS 9.8 CRITICAL / Published 2024-04-04A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler.View on NVD and CVE-2024-3273CVSS 9.8 CRITICAL / Published 2024-04-04A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler.View on NVD affect any D-Link ShareCenter NAS you still run, and check its patch status.
- Look for Pawns.app or similar bandwidth-sharing software running on hosts and appliances where no one approved it.
- Review authorized_keys and SSH configuration on edge devices for keys you cannot account for, since removing an application does not remove key-based access.
- Watch for outbound traffic patterns that do not match the device's purpose, for example a storage appliance carrying sustained proxy-style traffic.
- Decide which of these devices need to be internet-facing at all, and remove the rest from public exposure.
Edge hardware tends to be bought once and reviewed never. This campaign is a reminder that it is still part of your attack surface.