Threat reportThreat IntelligenceTL-2026-4174
Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322
Proxyjacking campaign hijacks 143+ edge devices in 34 (TL-2026-4174), also tracked as skynox7 proxyjacking campaign, is a high-severity tracked intrusion set scored CVSS 8.6, first published 2026-10-22. It has no confirmed attribution, affects Palo Alto Networks PAN-OS (PA-Series, VM-Series, Panorama virtual and, references 5 CVEs (CVE-2026-0322, CVE-2024-3272, CVE-2024-3273), maps to 8 MITRE ATT&CK techniques (T1036, T1059, T1090), and is covered by 9 detection rules and 14 indicators of compromise.
- CVSS
- 8.6/10High
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4174
- Threat ID
- TL-2026-4174
- Also known as
- skynox7 proxyjacking campaign
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, telecoms, government administration, enterprise, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Proxyjacking campaign hijacks 143+ edge devices in 34
Malware and tooling: Pawns.app
How Proxyjacking campaign hijacks 143+ edge devices in 34 works
GreyNoise reported a single operator (Pawns payout account skynox7@proton.me) exploiting old, known vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR and SAP NetWeaver to install Pawns.app on 143+ edge devices in 34 countries and monetize their bandwidth, in some cases adding SSH keys for backup access. Separately, Palo Alto Networks and CISA confirmed limited in-the-wild exploitation of CVE-2026-0322, an authenticated root code-execution flaw in the PAN-OS management interface.
This record tracks two related edge-device threats surfaced in Eclypsium's Below the Surface episode #84 (recorded 2026-10-19) and verified against primary sources.
Proxyjacking campaign: GreyNoise, while investigating suspicious activity at an unnamed organization, identified a malicious cyber actor conducting a proxyjacking campaign against network edge devices worldwide. The operator exploited known vulnerabilities - CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer - and installed Pawns.app, a legitimate bandwidth-sharing application that acts as a direct partner of IPRoyal, without the owners' consent. GreyNoise observed pre-compiled, pre-packaged Pawns.app variants that accept a username, password and device information at runtime, so the installing party can bind each victim to its own payout account (skynox7@proton.me). Exploitation traffic was observed from 209.99.190.80. GreyNoise confirmed 143+ compromised devices in 34 countries and also saw targeting of Hikvision and Dahua DVR/NVR devices (vulnerabilities not specified). In some cases the operator configured SSH key authentication as a backup access method. Routing traffic through victim residential/edge IPs lets resold proxy traffic appear trusted and defeats geolocation-based detections in authentication monitoring. The podcast describes the affected devices as Linux-based.
CVE-2026-0322: Palo Alto Networks published advisory CVE-2026-0322 on 2026-10-14 (updated 2026-10-15): an authenticated remote code execution (code injection, CWE-94) flaw in the PAN-OS management interface that lets an attacker with valid credentials and network access to the management interface execute arbitrary code as root. CVSS 4.0 base score 8.6 (HIGH). Palo Alto states very limited exploitation has been observed against the management interface and lists three associated IPs (66.42.72.14, 208.83.239.114, 149.248.47.234). CISA added the CVE to the KEV catalog on 2026-10-14 with a due date of 2026-10-17 and flagged forensic triage under BOD 26-04. Affected: PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) on PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2; Cloud NGFW and Prisma Access are not affected. No workaround is published; Threat Prevention IDs 510046/510047 give limited coverage and require SSL decryption and specific routing. The podcast notes the disclosure coincided with a reported 4.2% Palo Alto stock decline. No source links the PAN-OS exploitation to the proxyjacking operator; the two are related only by being discussed in the same episode and by targeting edge devices. Attribution for both is unknown.
MITRE ATT&CK techniques used in TL-2026-4174
Defense Evasion
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1090 Proxy; T1090.002 Proxy: External Proxy
Persistence
T1098.004 Account Manipulation: SSH Authorized Keys
Initial Access
T1190 Exploit Public-Facing Application
Impact
Resource Development
Affected products and versions in Proxyjacking campaign hijacks 143+ edge devices in 34
- Palo Alto Networks — PAN-OS (PA-Series, VM-Series, Panorama virtual and M-Series)
Vulnerable versions: 10.2; 11.1; 11.2; 12.1; 12.2
Fixed in: 12.2.4; 12.1.4-h12; 12.1.7-h8; 12.1.10-h2; 11.2.4-h22; 11.2.7-h21; 11.2.10-h15; 11.2.13-h3; 11.2.16; 11.1.4-h37 - D-Link — ShareCenter NAS
Vulnerable versions: Devices vulnerable to CVE-2024-3272 and CVE-2024-3273 - Ubiquiti — UniFi Video NVR
Vulnerable versions: Instances vulnerable to CVE-2021-44228 - SAP — NetWeaver Visual Composer
Vulnerable versions: Instances vulnerable to CVE-2025-31324 - Hikvision / Dahua — DVR/NVR devices
Vulnerable versions: Targeting observed; vulnerabilities not specified
Remediation for Proxyjacking campaign hijacks 143+ edge devices in 34
Patches
- Palo Alto Networks PAN-OS fixed versions per advisory CVE-2026-0322
- SAP Security Note for CVE-2025-31324 (NetWeaver Visual Composer)
- Ubiquiti UniFi Video update addressing Log4Shell CVE-2021-44228
- D-Link advisory for CVE-2024-3272/CVE-2024-3273 (ShareCenter NAS)
Immediate actions
- Upgrade PAN-OS to a fixed release for CVE-2026-0322 (e.g. 12.2.4, 12.1.4-h12/12.1.7-h8/12.1.10-h2, 11.2.4-h22 through 11.2.16, 11.1.4-h37 through 11.1.16-h3, 10.2.7-h38 through 10.2.18-h12)
- Restrict PAN-OS management interface access to trusted internal addresses or designated jump boxes
- Hunt for connections from 66.42.72.14, 208.83.239.114, 149.248.47.234 and 209.99.190.80
- Inventory edge devices (NAS, NVR/DVR, SAP NetWeaver) for unexpected Pawns.app/IPRoyal client processes and unauthorized SSH authorized_keys entries
- Perform forensic triage on PAN-OS devices with exposed management interfaces (CISA BOD 26-04)
Workarounds
- PAN-OS: no known workaround; Threat Prevention signatures 510046/510047 provide limited coverage with SSL decryption and specific routing
- Block inbound internet access to affected NAS/NVR/SAP services until patched or replaced
Longer-term hardening
- Remove internet exposure of management interfaces and NAS/NVR devices; place behind VPN or allowlist
- Retire end-of-life D-Link ShareCenter and legacy UniFi Video deployments
- Enforce strong unique credentials and MFA on management planes
- Monitor edge device egress for residential-proxy and bandwidth-sharing traffic
CVEs associated with Proxyjacking campaign hijacks 143+ edge devices in 34
CVE-2026-0322, CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, CVE-2025-31324
Weaknesses (CWE) in Proxyjacking campaign hijacks 143+ edge devices in 34
Timeline of Proxyjacking campaign hijacks 143+ edge devices in 34
- CVE-2021-44228 (Log4Shell), later exploited against Ubiquiti UniFi Video NVR in this campaign, is publicly disclosed
- CVE-2024-3272 and CVE-2024-3273 affecting D-Link ShareCenter NAS devices are disclosed; both are later used in the proxyjacking campaign
- CVE-2025-31324 in SAP NetWeaver Visual Composer is disclosed; it is later used to install Pawns.app on SAP systems
- CISA adds CVE-2026-0322 to the Known Exploited Vulnerabilities catalog with a 2026-10-17 due date
- Palo Alto Networks publishes advisory for CVE-2026-0322 (authenticated PAN-OS management interface RCE, CVSS 4.0 8.6) and reports very limited exploitation
- Palo Alto Networks updates the CVE-2026-0322 advisory; BleepingComputer covers the proxyjacking campaign
- GreyNoise publishes its skynox7 report: 143+ edge devices in 34 countries hijacked to run Pawns.app, with SSH keys added for backup access
- Eclypsium's Below the Surface episode #84 discusses both the proxyjacking campaign and active exploitation of CVE-2026-0322
Sources cited for Proxyjacking campaign hijacks 143+ edge devices in 34
- Memory Safety, AI security, Auth Challenges - BTS #84 (Eclypsium)
- GreyNoise: skynox7 - Proxyjacking Edge Devices Into Residential Proxies
- BleepingComputer: Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
- Palo Alto Networks Security Advisory CVE-2026-0322
- CISA KEV Catalog entry CVE-2026-0322
- SOC Prime: CVE-2026-0322 Actively Exploited PAN-OS RCE Flaw Enables Root Access
- Eclypsium: Pandora's Box - Vulns in Security Appliances
Detection coverage for TL-2026-4174
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4174 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4174
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.