# skynox7: Proxyjacking Edge Devices Into Residential Proxies (D-Link ShareCenter CVE-2024-3272/3273, UniFi Video CVE-2021-44228, SAP NetWeaver CVE-2025-31324)

> GreyNoise reports a financially motivated actor, skynox7, exploiting known vulnerabilities in edge devices (D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, SAP NetWeaver Visual Composer; Hikvision and Dahua DVR/NVR also targeted) and enrolling them in the Pawns.app residential proxy service under attacker-controlled credentials. At least 143 compromised devices across 34 countries were observed.

- **Published:** 2026-10-15T17:57:12Z
- **Last reviewed:** 2026-10-15T17:57:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3649
- **ID:** TL-2026-3649
- **Severity:** HIGH (CVSS 9.8)
- **Category:** IOT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, CVE-2025-31324

## Description

GreyNoise Labs documents a proxyjacking campaign by an actor identified as skynox7. The actor exploits unpatched internet-facing devices and installs the Pawns.app proxyware client, configured with attacker-specified account credentials, so that the victim's bandwidth and IP address are resold as a residential proxy exit node. Pawns.app is a residential-proxy supply service partnered with IPRoyal; the payout account tied to the campaign is skynox7@proton.me. GreyNoise observed at least 143 compromised devices in 34 countries.

Exploited vulnerabilities per GreyNoise: D-Link ShareCenter NAS CVE-2024-3272 and CVE-2024-3273, Ubiquiti UniFi Video NVR via Log4Shell CVE-2021-44228, and SAP NetWeaver Visual Composer CVE-2025-31324. Targeting of Hikvision and Dahua DVR/NVR devices was also observed, with the specific vulnerabilities not stated in the source. Exploitation traffic originated from 209.99.190.80. Beyond the Pawns.app payload, the actor configured SSH key authentication on victim devices as a backup access mechanism independent of Pawns.app. GreyNoise published seven SHA256 hashes for Pawns.app binary variants.

The defensive significance is twofold: compromised devices carry persistent attacker access and enrol the victim network as a proxy exit for third-party traffic, and residential proxy IPs are widely used by adversaries to defeat geolocation and impossible-travel detections. GreyNoise says the activity surfaced during a product demonstration when an organization found GreyNoise-flagged malicious IPs in Entra ID logs; multiple enterprise users were authenticating from the same residential IP addresses, a pattern indicating coordinated abuse rather than legitimate logins. Recommended defenses: patch edge devices, detect residential proxy IPs in authentication logs, analyze authentication anomalies beyond geolocation (device ID, session ID, User-Agent mismatches), use the GreyNoise IP check, and educate users about the risk of installing free software.

Background (NVD / CISA KEV, not from the GreyNoise post): CVE-2024-3272 (CWE-798, CVSS 9.8) is a hardcoded-credential backdoor and CVE-2024-3273 (CWE-77, CVSS 9.8) a command-injection flaw, both in /cgi-bin/nas_sharing.cgi of end-of-life D-Link NAS models DNS-320L, DNS-325, DNS-327L and DNS-340L; both were added to CISA KEV on 2024-04-11 with a retire-and-replace action. CVE-2025-31324 (CWE-434, CVSS 9.8) is an unauthenticated file-upload flaw in the SAP NetWeaver Visual Composer Metadata Uploader (SAP Note 3594142), added to KEV on 2025-04-29. CVE-2021-44228 (CVSS 10.0) is the Apache Log4j2 JNDI lookup remote code execution flaw, in KEV since 2021-12-10.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059.004 Unix Shell
- T1098.004 SSH Authorized Keys
- T1090 Proxy
- T1496.002 Bandwidth Hijacking

## Sources

- [skynox7: Proxyjacking Edge Devices Into Residential Proxies (GreyNoise)](https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies)
- [NVD - CVE-2024-3272](https://nvd.nist.gov/vuln/detail/CVE-2024-3272)
- [NVD - CVE-2024-3273](https://nvd.nist.gov/vuln/detail/CVE-2024-3273)
- [NVD - CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
- [NVD - CVE-2025-31324](https://nvd.nist.gov/vuln/detail/CVE-2025-31324)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [D-Link Security Advisory SAP10383](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383)
- [netsecfish/dlink - D-Link NAS nas_sharing.cgi PoC and analysis](https://github.com/netsecfish/dlink)
- [GreyNoise - CVE-2024-3273 D-Link NAS RCE exploited in the wild](https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild)
- [Proxyjacking attackers: Log4j exploited (Sysdig)](https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3649