Threat reportIoTTL-2026-3649
skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)
skynox7: Proxyjacking Edge Devices Into Residential Proxies (TL-2026-3649), also tracked as skynox7 proxyjacking campaign, is a high-severity IoT security threat scored CVSS 9.8, first published 2026-10-15. It has no confirmed attribution, affects D-Link ShareCenter NAS, references 4 CVEs (CVE-2024-3272, CVE-2024-3273, CVE-2021-44228), maps to 7 MITRE ATT&CK techniques (T1059.004, T1078.001, T1090), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 9.8/10High
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3649
- Threat ID
- TL-2026-3649
- Also known as
- skynox7 proxyjacking campaign
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- IOT
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, enterprise, surveillance, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in skynox7: Proxyjacking Edge Devices Into Residential Proxies
Malware and tooling: Pawns.app
How skynox7: Proxyjacking Edge Devices Into Residential Proxies works
GreyNoise reports a financially motivated actor, skynox7, exploiting known vulnerabilities in edge devices (D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, SAP NetWeaver Visual Composer; Hikvision and Dahua DVR/NVR also targeted) and enrolling them in the Pawns.app residential proxy service under attacker-controlled credentials. At least 143 compromised devices across 34 countries were observed.
GreyNoise Labs documents a proxyjacking campaign by an actor identified as skynox7. The actor exploits unpatched internet-facing devices and installs the Pawns.app proxyware client, configured with attacker-specified account credentials, so that the victim's bandwidth and IP address are resold as a residential proxy exit node. Pawns.app is a residential-proxy supply service partnered with IPRoyal; the payout account tied to the campaign is skynox7@proton.me. GreyNoise observed at least 143 compromised devices in 34 countries.
Exploited vulnerabilities per GreyNoise: D-Link ShareCenter NAS CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video NVR via Log4Shell CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324. Targeting of Hikvision and Dahua DVR/NVR devices was also observed, with the specific vulnerabilities not stated in the source. Exploitation traffic originated from 209.99.190.80. Beyond the Pawns.app payload, the actor configured SSH key authentication on victim devices as a backup access mechanism independent of Pawns.app. GreyNoise published seven SHA256 hashes for Pawns.app binary variants.
The defensive significance is twofold: compromised devices carry persistent attacker access and enrol the victim network as a proxy exit for third-party traffic, and residential proxy IPs are widely used by adversaries to defeat geolocation and impossible-travel detections. GreyNoise says the activity surfaced during a product demonstration when an organization found GreyNoise-flagged malicious IPs in Entra ID logs; multiple enterprise users were authenticating from the same residential IP addresses, a pattern indicating coordinated abuse rather than legitimate logins. Recommended defenses: patch edge devices, detect residential proxy IPs in authentication logs, analyze authentication anomalies beyond geolocation (device ID, session ID, User-Agent mismatches), use the GreyNoise IP check, and educate users about the risk of installing free software.
Background (NVD / CISA KEV, not from the GreyNoise post): CVE-2024-3272 (CWE-798, CVSS 9.8) is a hardcoded-credential backdoor and CVE-2024-3273 (CWE-77, CVSS 9.8) a command-injection flaw, both in /cgi-bin/nas_sharing.cgi of end-of-life D-Link NAS models DNS-320L, DNS-325, DNS-327L and DNS-340L; both were added to CISA KEV on 2024-04-11 with a retire-and-replace action. CVE-2025-31324 (CWE-434, CVSS 9.8) is an unauthenticated file-upload flaw in the SAP NetWeaver Visual Composer Metadata Uploader (SAP Note 3594142), added to KEV on 2025-04-29. CVE-2021-44228 (CVSS 10.0) is the Apache Log4j2 JNDI lookup remote code execution flaw, in KEV since 2021-12-10.
MITRE ATT&CK techniques used in TL-2026-3649
Execution
Initial Access
T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Command and Control
Persistence
Impact
Resource Development
Affected products and versions in skynox7: Proxyjacking Edge Devices Into Residential Proxies
- D-Link — ShareCenter NAS
Vulnerable versions: DNS-320L; DNS-325; DNS-327L; DNS-340L (end-of-life, CVE-2024-3272/CVE-2024-3273) - Ubiquiti — UniFi Video (NVR)
Vulnerable versions: Versions exposed to Log4Shell CVE-2021-44228 - SAP — NetWeaver Visual Composer
Vulnerable versions: Versions affected by CVE-2025-31324
Fixed in: Per SAP Note 3594142 - Hikvision — DVR/NVR
Vulnerable versions: Unspecified in source - Dahua — DVR/NVR
Vulnerable versions: Unspecified in source
Remediation for skynox7: Proxyjacking Edge Devices Into Residential Proxies
Patches
- Apply SAP Note 3594142 for CVE-2025-31324 (NetWeaver Visual Composer)
- Upgrade Log4j / UniFi Video components affected by CVE-2021-44228 (Log4j 2.16.0 or later, or patched 2.12.2/2.3.1)
- Retire and replace end-of-life D-Link ShareCenter devices (DNS-320L, DNS-325, DNS-327L, DNS-340L) affected by CVE-2024-3272/CVE-2024-3273; no vendor patch is available
Immediate actions
- Block 209.99.190.80 at the perimeter and review logs for connections from it
- Hunt edge devices for Pawns.app binaries matching the published SHA256 hashes and for unexpected outbound connections to residential proxy services
- Audit authorized_keys / SSH configuration on NAS, NVR and DVR devices for unrecognized keys
- Remove internet exposure of NAS, NVR/DVR management interfaces
- Check authentication logs for multiple users signing in from the same residential proxy IP (GreyNoise IP check)
Workarounds
- Disable or restrict nas_sharing.cgi and remote management on D-Link NAS devices
- Disable the SAP NetWeaver Visual Composer component if unused
- Restrict outbound traffic from edge devices to required destinations only
Longer-term hardening
- Enforce a device patching program for edge and IoT devices
- Detect residential proxy IPs in authentication logs and flag multiple users authenticating from the same residential proxy address
- Analyze authentication anomalies beyond geolocation: device ID, session ID, User-Agent mismatches
- Educate users on the risks of installing free software
CVEs associated with skynox7: Proxyjacking Edge Devices Into Residential Proxies
CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, CVE-2025-31324
Weaknesses (CWE) in skynox7: Proxyjacking Edge Devices Into Residential Proxies
Timeline of skynox7: Proxyjacking Edge Devices Into Residential Proxies
- Log4Shell (CVE-2021-44228), later exploited by skynox7 against Ubiquiti UniFi Video, is published in the NVD and added to CISA KEV the same day.
- D-Link ShareCenter NAS vulnerabilities CVE-2024-3272 (hardcoded credentials) and CVE-2024-3273 (command injection) in nas_sharing.cgi are published in the NVD; affected DNS-320L/325/327L/340L are end-of-life.
- CVE-2024-3272 and CVE-2024-3273 are added to the CISA KEV catalog (due date 2024-05-02, action: retire and replace affected hardware).
- SAP NetWeaver Visual Composer CVE-2025-31324 (unauthenticated Metadata Uploader file upload, CVSS 9.8) is published; SAP issues Note 3594142.
- CVE-2025-31324 is added to the CISA Known Exploited Vulnerabilities catalog.
- GreyNoise describes an organization that, during a product demonstration, found GreyNoise-flagged IPs in Entra ID logs with multiple users authenticating from the same residential proxy IPs.
- At least 143 compromised devices across 34 countries observed, enrolled with attacker-specified Pawns.app credentials (payout account skynox7@proton.me) and an SSH key backdoor.
- GreyNoise publishes analysis of skynox7 proxyjacking edge devices into Pawns.app residential proxies; start date of the campaign is not disclosed.
Sources cited for skynox7: Proxyjacking Edge Devices Into Residential Proxies
- skynox7: Proxyjacking Edge Devices Into Residential Proxies (GreyNoise)
- NVD - CVE-2024-3272
- NVD - CVE-2024-3273
- NVD - CVE-2021-44228
- NVD - CVE-2025-31324
- CISA Known Exploited Vulnerabilities Catalog
- D-Link Security Advisory SAP10383
- netsecfish/dlink - D-Link NAS nas_sharing.cgi PoC and analysis
- GreyNoise - CVE-2024-3273 D-Link NAS RCE exploited in the wild
- Proxyjacking attackers: Log4j exploited (Sysdig)
Detection coverage for TL-2026-3649
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3649 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3649
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.