Unpatched Routers Hijacked to Silently Sell Your Bandwidth
Attackers exploited well-known, publicly disclosed vulnerabilities (CVE-2024-3272 and CVE-2021-44228) in D-Link and Ubiquiti devices that had not been patched by their owners, compromising over 143 devices across 34 countries. By installing legitimate bandwidth-sharing software (Pawns.app) without user consent, threat actors monetize victims' internet connections while remaining difficult to detect through traditional malware scanning. This attack highlights the persistent danger of leaving network edge devices unpatched, as consumer and SMB-grade hardware is frequently overlooked in patch cycles. The campaign also demonstrates how attackers increasingly abuse legitimate tools to evade detection, making proactive vulnerability management and monitoring critical for network appliances.
Tactical Insight
Immediate actions
- Apply available firmware patches for CVE-2024-3272 (D-Link) and CVE-2021-44228 (Log4Shell) immediately, or replace end-of-life hardware that no longer receives updates.
- Audit all internet-facing routers and access points for unauthorized software installations or unexpected outbound traffic.
- Change all default credentials on network devices and disable remote management interfaces if not actively required.
Long-term improvements
- Maintain a complete, up-to-date inventory of all network appliances including firmware versions and end-of-support dates.
- Implement a formal patch management process that explicitly includes network edge devices (routers, access points, IoT hardware).
- Segment IoT and consumer-grade network devices onto isolated VLANs to limit their blast radius if compromised.
Detection measures
- Deploy network traffic monitoring to alert on unusual outbound bandwidth consumption or connections to known proxy-sharing platform endpoints.
- Enable syslog forwarding from all network devices to a centralized SIEM for anomaly detection and audit trail retention.
- Conduct periodic vulnerability scans targeting internet-facing infrastructure using tools such as Shodan monitoring or Tenable Nessus.