Cybercriminals use devices as internet relays

Cybercriminals are using known security flaws in connected devices to turn them into paid internet relays, according to cybersecurity researchers. This method allows attackers to earn money by routing internet traffic through the compromised devices without stealing data or holding users for ransom.

Exploited vulnerabilities in various devices

The campaign has targeted several types of devices, including network-attached storage (NAS) and video surveillance systems. Hackers used known vulnerabilities such as CVE-2024-3272 and CVE-2024-3273 on D-Link devices, and Log4Shell (CVE-2021-44228) on Ubiquiti UniFi Video recorders. Other vulnerabilities in SAP NetWeaver and Hikvision systems were also exploited.

Attackers install legitimate bandwidth-sharing software

Once devices were compromised, attackers installed Pawns.app, a legitimate software that allows users to share their internet connection in exchange for rewards. This software routes traffic through the user’s device, making it appear as though the traffic originates from the device’s IP address instead of the user’s.

Hackers control access through SSH keys

Researchers noted that some devices were configured to accept SSH keys controlled by the attackers, allowing them to access the devices remotely in the future. While the financial gains from this campaign are unknown, Pawns.app claims to have discontinued its bandwidth-sharing feature by 2026.

Risks for device owners are hidden and serious

Device owners may not notice the intrusion, but the compromised devices can be used to route fraudulent activity. This can lead to the victim’s IP address being blocked or monitored by online services. To reduce risks, users should update their devices and disable unnecessary remote access.

Older devices lack security updates

Some of the affected devices, like older D-Link NAS and Ubiquiti UniFi Video recorders, no longer receive security updates from their manufacturers. This makes it impossible to patch the vulnerabilities. The best solution is to replace these devices or isolate them from the internet if replacement is not feasible.

Steps to detect and remove the threat

If a device is suspected of being compromised, users should check for unauthorized Pawns.app installations, review SSH keys, and look for unusual outgoing connections. Removing Pawns.app does not guarantee the device is clean. A full reset, password change, and application of available patches are necessary before the device can be safely used again.