Attackers are still breaking into old internet-facing recorders and storage boxes, then renting the connection out as a residential proxy. GreyNoise published the finding on 15 October 2026.

What happened

GreyNoise traced a campaign it calls skynox7. The operator compromised at least 143 devices in 34 countries and installed Pawns.app, a legitimate bandwidth-sharing client, without the owner's consent. Traffic from a commercial residential proxy network then flows through the victim's link, and the attacker collects the payout.

The report names three exploit paths. On Ubiquiti UniFi Video network video recorders the path is CVE-2021-44228, the Log4Shell flaw in Apache Log4j2. On D-Link ShareCenter NAS the paths are CVE-2024-3272, hard-coded credentials, and CVE-2024-3273, command injection. Both D-Link issues are marked unsupported when assigned. SAP NetWeaver Visual Composer was also targeted. Hikvision and Dahua recorders were probed, but GreyNoise did not name a CVE for those.

On some devices the attacker also installed an SSH key so they can come back after the proxy client is removed. GreyNoise did not publish a start date for the campaign.

Who is affected

• Sites still running Ubiquiti UniFi Video, the older NVR product, especially if it faces the internet. UniFi Network is a different product and is not what this report names.
• D-Link ShareCenter models DNS-320L, DNS-325, DNS-327L and DNS-340L. The vendor says these are end of life and will not be patched. The hard-coded credential flaw is scored 9.8.
• Any small office that left an old NAS, NVR or DVR on a public IP and assumed nobody would notice it.

What to do now

Take UniFi Video and end-of-life D-Link NAS off the internet today, then replace them.

• Find UniFi Video recorders, D-Link ShareCenter units, and Hikvision or Dahua DVRs that still have a public address or a port forward.
• Do not treat a firmware check as a fix for the named D-Link models. The vendor's instruction is to retire and replace them.
• On any recorder you must keep, restrict it to the LAN, change every admin password, and check for an unexpected SSH authorized key.
• Watch outbound traffic from those devices. A quiet box that suddenly opens long-lived connections to a proxy network is the signal here.
• If several staff Microsoft 365 sign-ins arrive from the same residential IP, treat that as a separate investigation, not as a VPN glitch. GreyNoise found that pattern while looking at this class of proxy.

What this means for South African businesses

A lot of local SMEs still have a UniFi Video recorder or a cheap NAS from a few years ago sitting on the same public IP as the firewall. Those boxes are not in anyone's patch cycle, which is exactly why this campaign still works in 2026. The practical risk is not a dramatic ransomware note. It is your office IP being resold, then used for fraud or credential attacks that get blamed on you.

Source: GreyNoise, skynox7: Proxyjacking Edge Devices Into Residential Proxies.