[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUFi_6CRFcpHchPagDfb4eeY8a76o24sg8Vyla5lfXGk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"a4a94f2c-f573-42c8-a954-9a96ada69c51","unpatched-routers-hijacked-to-silently-sell-your-bandwidth","11e4bf7e-c2e7-4438-9d27-6a8c73f5be6e","Unpatched Routers Hijacked to Silently Sell Your Bandwidth","Attackers exploited well-known, publicly disclosed vulnerabilities (CVE-2024-3272 and CVE-2021-44228) in D-Link and Ubiquiti devices that had not been patched by their owners, compromising over 143 devices across 34 countries. By installing legitimate bandwidth-sharing software (Pawns.app) without user consent, threat actors monetize victims' internet connections while remaining difficult to detect through traditional malware scanning. This attack highlights the persistent danger of leaving network edge devices unpatched, as consumer and SMB-grade hardware is frequently overlooked in patch cycles. The campaign also demonstrates how attackers increasingly abuse legitimate tools to evade detection, making proactive vulnerability management and monitoring critical for network appliances.","**Immediate actions:**\n- Apply available firmware patches for CVE-2024-3272 (D-Link) and CVE-2021-44228 (Log4Shell) immediately, or replace end-of-life hardware that no longer receives updates.\n- Audit all internet-facing routers and access points for unauthorized software installations or unexpected outbound traffic.\n- Change all default credentials on network devices and disable remote management interfaces if not actively required.\n\n**Long-term improvements:**\n- Maintain a complete, up-to-date inventory of all network appliances including firmware versions and end-of-support dates.\n- Implement a formal patch management process that explicitly includes network edge devices (routers, access points, IoT hardware).\n- Segment IoT and consumer-grade network devices onto isolated VLANs to limit their blast radius if compromised.\n\n**Detection measures:**\n- Deploy network traffic monitoring to alert on unusual outbound bandwidth consumption or connections to known proxy-sharing platform endpoints.\n- Enable syslog forwarding from all network devices to a centralized SIEM for anomaly detection and audit trail retention.\n- Conduct periodic vulnerability scans targeting internet-facing infrastructure using tools such as Shodan monitoring or Tenable Nessus.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SP 800-115: Technical Guide to Information Security Testing","NIST CSF DE.CM-1: Network monitoring to detect cybersecurity events","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","ITIL: Change and Release Management (firmware update governance)","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",{},"published","2026-10-15T20:21:08.021354+00:00","2026-10-15T20:21:08.002+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth\u002F","hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth-f6df72","Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[51,54,57],{"slug":34,"name":52,"problem":53},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":55,"problem":56},"Automated patch management","Known holes get closed in days, not months.",{"slug":58,"name":59,"problem":60},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]