Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

Attackers exploited well-known, publicly disclosed vulnerabilities (CVE-2024-3272 and CVE-2021-44228) in D-Link and Ubiquiti devices that had not been patched by their owners, compromising over 143 devices across 34 countries. By installing legitimate bandwidth-sharing software (Pawns.app) without user consent, threat actors monetize victims' internet connections while remaining difficult to detect through traditional malware scanning. This attack highlights the persistent danger of leaving network edge devices unpatched, as consumer and SMB-grade hardware is frequently overlooked in patch cycles. The campaign also demonstrates how attackers increasingly abuse legitimate tools to evade detection, making proactive vulnerability management and monitoring critical for network appliances.