# Attackers turn at least 143 devices into paid proxy nodes

_Published Thursday, October 15, 2026 at 3:07 PM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![Attackers turn at least 143 devices into paid proxy nodes — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/15/intrernet.jpg)

GreyNoise identified at least 143 compromised devices across 34 countries in a campaign that monetizes victims' internet connections, BleepingComputer reports. The operator installed Pawns.app, a legitimate bandwidth-sharing application, without device owners' consent.

Attackers exploited vulnerabilities in D-Link ShareCenter NAS devices, Ubiquiti UniFi Video NVR systems and SAP NetWeaver Visual Composer. GreyNoise also observed targeting of Hikvision and Dahua recorders and, in some cases, SSH keys configured for backup access. Proxy traffic can expose device owners to IP address blocks or allegations of involvement in illegal activity.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/)

---
Canonical: https://techandbusiness.org/newswire/KbOeBi55oCPmzNf4Gd0W6o
Published: 2026-10-15T19:07:08.072Z
Story chronology: 2026-10-15T18:20:59.000Z
Retrieved: 2026-10-15T22:49:26.679Z
Publisher: Tech & Business (techandbusiness.org)