Welcome to the future, where hackers have figured out how to monetize your internet connection and, naturally, it’s happening on a global scale. A bright idea has popped up seemingly out of nowhere: why not hijack D-Link and Ubiquiti devices in 34 countries and resell stolen bandwidth? Genius, right?
The Great Bandwidth Heist
These masterminds have meticulously installed a bandwidth-sharing app called Pawns.app on unsuspecting devices—think of it as "sharing is caring" but for bandwidth thieves. This app, which is apparently legitimate (because what could possibly go wrong?), allows people to earn money by letting others use their internet connection. Little do the owners know, those connections are now cash cows for our digital Robin Hoods.
By cramming this app onto multiple systems, it appears our hacker friends are raking in the dough like it’s Black Friday.
The Numbers Game
The brains over at GreyNoise uncovered this astonishing operation while snooping around an unnamed organization like curious raccoons. They found 143 compromised devices and tracked several vulnerabilities that were exploited to get inside. Apparently, even tech giants can't keep their systems safe:
- D-Link ShareCenter NAS: CVE-2024-3272 and CVE-2024-3273
- Ubiquiti UniFi Video NVR: CVE-2021-44228
- SAP NetWeaver Visual Composer: CVE-2025-31324
They even toyed around with some Hikvision and Dahua DVR/NVR devices but conveniently skipped the details—because honestly, who has time for that?
SSH? More Like SSH-ooo No!
The hackers backtracked their way into systems, sometimes setting up SSH key authentication for their cozy little getaway. Just imagine, a group of hackers sitting in a dimly lit room, giggling as they bypass security measures and high-fiving over their new side hustle in bandwidth redistribution.
The Legal Line
Now, let’s not forget the legitimate side of this operation. Even the "good" proxy networks can unwittingly route dodgy traffic through innocent users. That means you could end up flagged as a criminal mastermind, all thanks to someone else’s lack of oversight. The FBI even warned us about how these networks can be the underbelly of credential stuffing attacks. Delightful!
What Can You Do?
Pro tip: Maybe think twice before downloading random apps off the internet—shocking, I know! Stick with trusted sources, and for goodness' sake, keep those devices updated. There's also the classic “strong passwords and limit your network access” guideline, which, believe it or not, still works wonders in 2026.
So, in summary, while hackers are out there turning your devices into bandwidth-selling machines, just remember to lock your doors, both physically and digitally. Good luck out there!
