Security analysts have watched threat actors pivot away from traditional cryptojacking toward a more covert, highly lucrative enterprise: proxyjacking. Rather than burning a victim's CPU cycles to mine fractional crypto, attackers hijack internet routers, network-attached storage (NAS) units, and digital video recorders (DVR/NVRs) to monetize stolen household and enterprise bandwidth through commercial residential proxy networks.
Recent telemetry uncovered by threat intelligence researchers details a sprawling global campaign affecting devices across 34 countries. As modern ai cybersecurity companies ramp up automated telemetry and behavioral anomaly detection, understanding how these residential proxy schemes operate has become critical for corporate threat assessments and edge-device hardening.
How AI Cybersecurity Companies Track Rogue Proxy Nodes
For years, defenders have relied on straightforward infrastructure attribution to flag malicious activity. Security systems routinely flag requests originating from known virtual private network (VPN) providers, virtual private servers (VPS), or datacenter IPs as anomalous. However, stealthy adversaries have shifted toward residential proxies, which fundamentally break core assumptions about the detectable characteristics of malicious infrastructure.
When traffic originates from a residential IP address located in a legitimate geographic region, standard geolocation filters and "impossible travel" alerts fail to trigger. Advanced threat intelligence platforms and ai cybersecurity companies have had to evolve their detection logic. By analyzing enterprise identity and access management (IAM) logs—such as Microsoft Entra ID sign-in telemetry—security analysts can spot suspicious patterns, such as multiple distinct enterprise users authenticating through the exact same residential IP address under unlikely conditions.
Modern behavioral anomaly engines go beyond basic IP reputation. They inspect deviations in user authentication characteristics, including mismatches in device identifiers, session fingerprints, and User-Agent strings. This multi-layered visibility allows security teams to separate legitimate remote workers from co-opted proxy nodes participating in unauthorized bandwidth-sharing schemes.
The Mechanics of the 34-Country Proxyjacking Campaign
A recent investigation by threat intelligence firm GreyNoise shed light on a sophisticated global proxyjacking campaign that successfully compromised at least 143 edge devices across 34 countries. Unlike voluntary "earn on your internet" programs where individuals willingly share their bandwidth for passive income, this campaign represents malicious forced monetization—commonly termed proxyjacking.
The threat actors installed Pawns.app, a legitimate bandwidth-sharing application developed by IPRoyal, directly onto victim devices without the owners' knowledge or consent. Pawns.app rewards account holders for routing external traffic through their local network, provided the IP address is clean and unblocked. By mass-deploying the application across unsecured edge infrastructure, the attacker scaled their operational footprint to maximize financial payouts from the proxy network.
The use of legitimate commercial software wrapped in malicious deployment vectors presents a unique challenge for automated endpoint protection. Because the binaries themselves are benign bandwidth-sharing utilities, traditional signature-based antivirus solutions often fail to flag them unless the unauthorized installation context is uncovered.
Exploited Vulnerabilities and Attack Vectors
To deploy proxyware like Pawns.app onto target environments, the attackers leveraged a combination of known vulnerabilities affecting internet-facing edge devices and network appliances. Telemetry from the campaign highlights several specific flaws exploited during the intrusions:
- D-Link ShareCenter NAS: Attackers exploited remote code execution flaws tracked as
CVE-2024-3272andCVE-2024-3273. - Ubiquiti UniFi Video NVR: Systems were breached using older vulnerabilities, notably
CVE-2021-44228. - SAP NetWeaver Visual Composer: Attackers targeted enterprise infrastructure via
CVE-2025-31324. - Hikvision and Dahua Devices: The campaign also actively scanned and targeted various digital video recorders and network video recorders from major manufacturers, utilizing specialized exploits.
Beyond installing the proxy software, threat intelligence researchers observed that the attackers frequently established persistent backdoor access. In several instances, actors configured secure shell (SSH) key authentication as a resilient secondary access vector, ensuring they could maintain control even if primary application vulnerabilities were patched.
Implications for Corporate Threat Assessments and Defense
The weaponization of residential edge devices carries severe collateral damage for device owners and enterprise networks alike. Participating nodes are frequently abused to route illicit traffic, launch credential-stuffing attacks against financial platforms—an activity previously warned about by the FBI—or execute web scraping campaigns. Consequently, victim IP addresses frequently end up blacklisted, and owners face potential legal scrutiny or allegations of involvement in cybercrime.
For security leaders integrating these insights into corporate threat assessments, mitigating proxyjacking requires a proactive approach centered on edge hygiene and behavioral monitoring:
- Rigorous Patch Management: Ensure all internet-facing network appliances, NAS units, and video surveillance systems are promptly updated with the latest vendor firmware and security patches.
- Authentication Log Scrutiny: Continuously audit IAM and single sign-on (SSO) logs for residential IP addresses, specifically flagging instances where multiple users authenticate from the same residential node.
- Endpoint and Application Visibility: Restrict unauthorized software downloads on corporate endpoints and edge hardware, preventing the silent installation of unvetted proxyware or remote management tools.
- Network Segmentation and Least Privilege: Isolate edge devices from internal core segments to ensure that a compromise of a NAS or NVR does not provide lateral movement vectors into sensitive enterprise databases.
As adversaries continue to innovate around infrastructure obfuscation, the intersection of network device security and advanced AI-driven telemetry will remain the frontline defense for modern organizations.
