Proxyjacking Hijacks NAS and NVR Devices for Residential Proxies: Entra ID Detection Tips

A global "proxyjacking" campaign discovered by threat intelligence firm GreyNoise and reported by BleepingComputer has compromised at least 143 internet-facing edge devices across 34 countries. Instead of deploying noisy ransomware or burning out CPUs with cryptocurrency miners, the threat actor behind this operation quietly installed legitimate commercial bandwidth-sharing software to turn victim hardware into residential proxy nodes—and pocket the payouts.

For home lab enthusiasts, small business owners, and enterprise Microsoft Entra ID administrators alike, this campaign is a sharp reminder of two converging realities in modern cybersecurity: unpatched network appliances remain low-hanging fruit, and residential proxy networks are systematically breaking traditional geolocation-based login defenses.

What Is Proxyjacking, and How Did Pawns.app Get Involved?​

To understand proxyjacking, it helps to first understand the legitimate "earn on your internet" economy. Commercial proxy providers constantly need fresh, reputable residential IP addresses assigned by normal Internet Service Providers (ISPs). Unlike datacenter or commercial VPN IP addresses—which websites and security tools routinely block or flag—residential IPs look like ordinary consumers sitting on their couches.

One prominent player in this space is Pawns.app, a bandwidth-sharing platform that GreyNoise notes is a direct partner and apparent rebrand of IPRoyal Pawns. Under the voluntary model, everyday users install the Pawns.app client on their computers or phones, consent to share a sliver of their unused internet connection, and earn passive income in return.

However, GreyNoise researchers point out that Pawns.app also provides pre-compiled, pre-packaged command-line variants of its software—some of which are only visible after creating an account on the platform. These command-line builds accept runtime variables including a username, password, and device information. While handy for power users deploying the software across their own hardware fleet, that exact design makes it trivial for an attacker who has breached someone else's Linux-based NAS or video recorder to silently enroll the victim's connection under the attacker's own payout account.

That is where voluntary bandwidth sharing crosses the line into proxyjacking: forcibly enrolling compromised devices into a proxy network without the owner's knowledge or consent to monetize their bandwidth. As GreyNoise emphasizes, the Pawns.app binaries themselves are not inherently malware; they become a security threat when installed without authorization on hijacked infrastructure.

The Targets: D-Link, Ubiquiti, SAP, and Security Recorders​

According to GreyNoise's analysis, the threat actor—tracked via a payout account registered to the email address [email][email protected][/email] and launching exploits from the IP address 209.99.190.80—did not need zero-day magic to build this 143-device proxy farm. Instead, the operator relied on a greatest-hits collection of known vulnerabilities across consumer, prosumer, and enterprise systems:

In addition to those confirmed exploit paths, GreyNoise observed the attacker targeting digital video recorders and network video recorders (DVRs/NVRs) manufactured by Hikvision and Dahua, though the specific vulnerabilities used against those video systems were not disclosed.

Once inside a vulnerable device, the attacker did more than just drop the Pawns.app binary. In several instances, GreyNoise observed the operator configuring SSH public-key authentication on the compromised appliances as a backup access mechanism. That detail is critical for system administrators: simply terminating a rogue proxy process or deleting an unfamiliar binary will not kick the attacker out if they have planted their own SSH keys in the device's configuration.

Section Summary:

• At least 143 devices across 34 countries were hijacked to run Pawns.app command-line binaries tied to an attacker's payout account.
• Known flaws in D-Link ShareCenter NAS units, Ubiquiti UniFi Video NVRs, and SAP NetWeaver Visual Composer were actively exploited.
• Attackers also targeted Hikvision and Dahua DVR/NVR systems and planted SSH keys on some victim devices to maintain persistent backdoor access.

The Microsoft Entra ID Connection: How a Live Demo Uncovered an Intrusion​

Perhaps the most fascinating aspect of GreyNoise's disclosure is how researchers stumbled onto the trail in the first place. It started during a live product demonstration for an unnamed organization.

While reviewing the organization's Microsoft Entra ID sign-in logs during the demo, GreyNoise spotted login events originating from IP addresses that its intelligence feed flagged as malicious. Here was the catch: those IP addresses were residential connections located in geographic regions that made complete sense for the organization's workforce.

In any Windows and Microsoft 365 environment, defenders walk a fine line with residential proxy alerts. Because an ordinary home network might have a smart TV, a teenager's laptop running a free bandwidth-sharing app, or a compromised router sitting behind the same ISP router, a single residential IP address can simultaneously send legitimate employee Entra ID logins and relay malicious traffic for an unrelated cybercriminal. Seeing a residential proxy flag in Entra ID is a yellow light, not automatic proof of a breach.

However, when the organization dug deeper into its Entra ID logs, it uncovered a smoking gun: multiple distinct users were authenticating from the exact same residential proxy IP address. Unless half the company happens to be carpooling from the same living room, multiple enterprise accounts funneling through a single external residential node is a massive red flag. The organization escalated its response and confirmed it was dealing with a serious, active intrusion.

While GreyNoise kept the details of that specific enterprise breach confidential—and did not state that the organization's intruder was using the skynox7 Pawns.app nodes specifically—that incident spurred the follow-up research into commercial residential proxy abuse that exposed the 143-device proxyjacking campaign.

Why Residential Proxies Keep Security Teams Awake at Night​

Why are threat actors—ranging from opportunistic fraudsters to foreign intelligence services—so obsessed with residential proxies? Because they neutralize one of the oldest tricks in the blue-team playbook: "Impossible Travel" and geolocation anomaly detection.

In a March 2026 public service announcement (Alert I-031226-PSA), the FBI warned that cyber threat actors systematically abuse residential proxies to route traffic through home and small business networks, making the innocent connection owner appear responsible for whatever happens next. According to the FBI advisory, criminals use these hijacked connections for:

• Account takeovers and phishing: If an attacker buys leaked corporate or banking credentials, they can select a residential proxy in the victim's exact city and state, logging in without tripping location-based security alerts.
• Brute-force attacks: Rotating rapidly through thousands of residential IPs allows attackers to hammer login portals while bypassing rate limits and IP lockouts.
• Command-and-control (C2) obfuscation and data exfiltration: Routing malware communications and stolen data through home networks makes it far harder for defenders and law enforcement to trace the true origin of an attack.
• Fraud and scalping: Bypassing regional locks or purchase limits to buy up scarce goods or create fake accounts at scale.

For the everyday PC or NAS owner whose device gets silently recruited into a proxy network, the fallout isn't just slightly slower Netflix speeds. As BleepingComputer and the FBI note, when criminals route abusive traffic through your home IP address, your connection can get blacklisted by major web services, leaving you locked out of banking sites, gaming networks, or work portals—or worse, drawing scrutiny for illegal activity that passed through your router.

Actionable Defense: Hardening Your Network and Entra ID Logs​

Whether you are protecting a home lab stacked with Ubiquiti and D-Link gear or defending a corporate Microsoft 365 tenant, addressing proxyjacking requires looking at both ends of the pipe: preventing your edge devices from becoming proxy nodes, and spotting attackers who use residential proxies against your identity infrastructure.

1. For Home Lab, NAS, and Small Business Administrators​

• Audit and isolate internet-facing appliances: Ask yourself a brutally honest question: does your D-Link NAS, Ubiquiti NVR, or security camera system really need its management port exposed directly to the public internet? Put storage and video recorders behind a VPN or zero-trust access tunnel rather than forwarding ports on your router.
• Patch known vulnerabilities immediately: Ensure firmware is updated across all network appliances, paying special attention to D-Link ShareCenter NAS devices (CVE-2024-3272, CVE-2024-3273), Ubiquiti UniFi Video NVRs (CVE-2021-44228), and enterprise SAP NetWeaver installations (CVE-2025-31324). If a legacy NAS or NVR has reached end-of-life and no longer receives security patches, sever its direct internet access immediately.
• Hunt for Indicators of Compromise (IoCs) and rogue SSH keys: If you manage Linux-based edge devices, inspect running processes and file systems for unauthorized command-line proxy binaries. GreyNoise published several SHA-256 hashes associated with the Pawns.app binaries observed in this campaign (including e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd and fdc18f4287c1c6a285c664d3ce0f17d3479bc246bc6c163eb90b1a84adb453a7), alongside the exploitation IP 209.99.190.80 and payout account [email][email protected][/email]. Crucially, check your device's authorized_keys files and SSH configuration; if an attacker planted a backup SSH key, deleting the proxy binary alone will not secure the box. As the FBI advises, heavily compromised IoT and edge devices often require a full operating system or firmware reinstallation to guarantee persistence mechanisms are wiped clean.
• Check your public IP reputation: GreyNoise offers a free, account-required lookup tool that lets users check whether their public IP address has interacted with its Global Observation Grid—a helpful early warning sign that a device on your local network may be acting as a proxy node.

2. For Windows Enterprise and Microsoft Entra ID Defenders​

• Correlate residential proxy IPs across multiple accounts: As GreyNoise's incident response case demonstrated, a single user logging in from a residential proxy IP might just be working from a home network where a family member installed proxyware. Multiple enterprise users authenticating from the same residential proxy IP, however, is a high-confidence indicator of an active attack. Build SIEM and Microsoft Sentinel detection rules specifically looking for multi-user clustering on known residential proxy addresses.
• Look beyond geolocation in authentication logs: Because residential proxies let attackers pick an IP address right down to the target's city, geolocation and "Impossible Travel" alerts are no longer enough. GreyNoise recommends scrutinizing authentication telemetry for mismatches in device identifiers, session identifiers, and User-Agent strings. Enforcing phishing-resistant multifactor authentication (MFA) and Entra ID Conditional Access policies requiring compliant, domain-joined or Intune-managed devices will stop an attacker cold—even if they are knocking on the door from a residential IP address right across the street.

Section Summary:

• GreyNoise uncovered the proxy research after spotting malicious-flagged residential IPs in an organization's Microsoft Entra ID logs, where multiple users authenticated from a single residential proxy address.
• Residential proxies allow attackers to bypass geolocation checks, conduct brute-force attacks, and mask command-and-control traffic.
• Administrators should remove NAS and NVR devices from direct internet exposure, check for unauthorized SSH keys, and configure Entra ID monitoring to flag multiple users sharing residential proxy IPs and mismatches in device or session identifiers.