# Proxyjacking campaign hijacks 143+ edge devices in 34 countries (D-Link, Ubiquiti, SAP) to resell bandwidth via Pawns.app, plus active exploitation of PAN-OS CVE-2026-0322

> GreyNoise reported a single operator (Pawns payout account skynox7@proton.me) exploiting old, known vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR and SAP NetWeaver to install Pawns.app on 143+ edge devices in 34 countries and monetize their bandwidth, in some cases adding SSH keys for backup access. Separately, Palo Alto Networks and CISA confirmed limited in-the-wild exploitation of CVE-2026-0322, an authenticated root code-execution flaw in the PAN-OS management interface.

- **Published:** 2026-10-22T19:06:47Z
- **Last reviewed:** 2026-10-22T19:06:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4174
- **ID:** TL-2026-4174
- **Severity:** HIGH (CVSS 8.6)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0322, CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, CVE-2025-31324

## Description

This record tracks two related edge-device threats surfaced in Eclypsium's Below the Surface episode #84 (recorded 2026-10-19) and verified against primary sources.

Proxyjacking campaign: GreyNoise, while investigating suspicious activity at an unnamed organization, identified a malicious cyber actor conducting a proxyjacking campaign against network edge devices worldwide. The operator exploited known vulnerabilities - CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer - and installed Pawns.app, a legitimate bandwidth-sharing application that acts as a direct partner of IPRoyal, without the owners' consent. GreyNoise observed pre-compiled, pre-packaged Pawns.app variants that accept a username, password and device information at runtime, so the installing party can bind each victim to its own payout account (skynox7@proton.me). Exploitation traffic was observed from 209.99.190.80. GreyNoise confirmed 143+ compromised devices in 34 countries and also saw targeting of Hikvision and Dahua DVR/NVR devices (vulnerabilities not specified). In some cases the operator configured SSH key authentication as a backup access method. Routing traffic through victim residential/edge IPs lets resold proxy traffic appear trusted and defeats geolocation-based detections in authentication monitoring. The podcast describes the affected devices as Linux-based.

CVE-2026-0322: Palo Alto Networks published advisory CVE-2026-0322 on 2026-10-14 (updated 2026-10-15): an authenticated remote code execution (code injection, CWE-94) flaw in the PAN-OS management interface that lets an attacker with valid credentials and network access to the management interface execute arbitrary code as root. CVSS 4.0 base score 8.6 (HIGH). Palo Alto states very limited exploitation has been observed against the management interface and lists three associated IPs (66.42.72.14, 208.83.239.114, 149.248.47.234). CISA added the CVE to the KEV catalog on 2026-10-14 with a due date of 2026-10-17 and flagged forensic triage under BOD 26-04. Affected: PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) on PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2; Cloud NGFW and Prisma Access are not affected. No workaround is published; Threat Prevention IDs 510046/510047 give limited coverage and require SSL decryption and specific routing. The podcast notes the disclosure coincided with a reported 4.2% Palo Alto stock decline. No source links the PAN-OS exploitation to the proxyjacking operator; the two are related only by being discussed in the same episode and by targeting edge devices. Attribution for both is unknown.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1059 Command and Scripting Interpreter
- T1496 Resource Hijacking
- T1090 Proxy
- T1090.002 Proxy: External Proxy
- T1588.002 Obtain Capabilities: Tool
- T1036 Masquerading

## Sources

- [Memory Safety, AI security, Auth Challenges - BTS #84 (Eclypsium)](https://eclypsium.com/podcasts/memory-safety-ai-security-auth-challenges-bts-84/)
- [GreyNoise: skynox7 - Proxyjacking Edge Devices Into Residential Proxies](https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies)
- [BleepingComputer: Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth](https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/)
- [Palo Alto Networks Security Advisory CVE-2026-0322](https://security.paloaltonetworks.com/CVE-2026-0322)
- [CISA KEV Catalog entry CVE-2026-0322](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322)
- [SOC Prime: CVE-2026-0322 Actively Exploited PAN-OS RCE Flaw Enables Root Access](https://socprime.com/?p=54512)
- [Eclypsium: Pandora's Box - Vulns in Security Appliances](https://eclypsium.com/research/pandoras-box-vulns-in-security-appliances/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4174