Hackers Compromise Devices to Sell Stolen Bandwidth
Cybercriminals are infecting global network hardware to monetize internet access through unauthorized proxy networks.
Updated on Oct. 15, 2026 in Cybersecurity
Live Poll
Do you trust that your internet-connected devices are secure enough to prevent remote hijacking?
Hackers have compromised internet-connected devices across 34 countries to install bandwidth-sharing software. This campaign targets vulnerabilities in network-attached storage and video recording hardware to resell victim internet connections.
Why it matters
The attack represents a growing trend of proxyjacking, where attackers exploit edge devices to turn private networks into commercial proxies. This monetization strategy exploits household and business hardware to bypass security measures and mask malicious traffic.
The attackers exploited specific vulnerabilities including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, along with CVE-2021-44228 in Ubiquiti UniFi Video NVR. They also installed Pawns.app and configured SSH keys as a persistent backup.
The players
GreyNoise
GreyNoise is a cybersecurity firm that tracks and collects data on internet-wide malicious activity to help organizations identify threats.
Pawns.app
Pawns.app is a commercial platform that allows users to share their unused internet bandwidth in exchange for monetary compensation.
The details
Attackers breached edge hardware including Hikvision and Dahua DVR/NVR units to surreptitiously run Pawns.app. By weaponizing these internet-connected devices, the actors successfully built a proxy network to resell stolen bandwidth for commercial gain.
Timeline
October 15, 2026: The global proxyjacking campaign is reported.
The Tech Race
This incident highlights how the Pawns.app bandwidth-sharing service is being weaponized in the cybersecurity landscape, where similar services could face increased scrutiny for enabling proxyjacking. The campaign marks a shift toward utilizing automated exploitation to turn existing edge hardware into involuntary revenue-generating assets.
Users with internet-connected devices like DVRs or NAS units should update their firmware immediately to patch known vulnerabilities and block unauthorized access. Owners should also audit their devices for unrecognized SSH keys or background applications that could be consuming bandwidth.
The takeaway
Securing edge hardware is critical as cybercriminals increasingly target devices with weak authentication or unpatched software. Regularly updating your home and office network equipment is the most effective defense against unauthorized proxyjacking.
Further reading
Learn more about emerging digital threats on our Cybersecurity section page.
Live Poll
Do you trust that your internet-connected devices are secure enough to prevent remote hijacking?
