skynox7 proxyjacking campaign compromises 143+ edge devices in 34 countries to install Pawns.app residential proxy software
GreyNoise reports a proxyjacking campaign by a malicious cyber actor (tracked as skynox7) that exploited network edge devices globally to covertly install Pawns.app proxyware and monetize victims' bandwidth. At least 143 devices in 34 countries were compromised, and the actor also appeared to target other DVR/NVR brands such as Hikvision and Dahua. The research grew out of a GreyNoise product demo, in which an organization found GreyNoise-labeled malicious residential IPs in its Entra ID sign-in logs. Further investigation showed multiple users authenticating from the same residential IP, and the organization confirmed a serious intrusion. GreyNoise will not publish details of that intrusion. Residential proxies defeat geolocation-based detections such as impossible-travel alerts, and foreign intelligence entities continue to use them.
Technical Details
- Pawns.app is a partner of IPRoyal and appears to be a rebrand of IPRoyal Pawns. It offers pre-compiled command-line variants that accept username, password and device parameters at runtime, which makes silent installation on devices the operator does not own easy.
- The actor gained access to edge devices (including DVR/NVR) by exploiting vulnerabilities. The article text does not list the specific CVEs.
- In some cases the actor configured victim devices to accept SSH key authentication from the attacker as a backup access method.
- The binaries are not necessarily malware unless installed without consent.
- No IOCs are provided in the article text.
Remediation
- Detect residential proxy IPs in authentication logs, and scrutinize cases where multiple enterprise users authenticate from the same residential proxy IP.
- Detect deviations in authentication behavior beyond geolocation, such as mismatched device identifiers, session identifiers or User-Agent strings.
- Educate users about the risks of installing free applications and about keeping personal devices patched.
- Patch edge devices such as DVR/NVR and review them for unauthorized SSH keys.
- Use GreyNoise's free service to check whether an IP has interacted with its Global Observation Grid, a potential indicator of proxyjacking.
Linha do tempo
-
skynox7 proxyjacking campaign compromises 143+ edge devices in 34 countries to install Pawns.app residential proxy software
ler a análise desta fonte ocultar
GreyNoise reports a proxyjacking campaign by a malicious cyber actor (tracked as skynox7) that exploited network edge devices globally to covertly install Pawns.app proxyware and monetize victims' bandwidth. At least 143 devices in 34 countries were compromised, and the actor also appeared to target other DVR/NVR brands such as Hikvision and Dahua. The research grew out of a GreyNoise product demo, in which an organization found GreyNoise-labeled malicious residential IPs in its Entra ID sign-in logs. Further investigation showed multiple users authenticating from the same residential IP, and the organization confirmed a serious intrusion. GreyNoise will not publish details of that intrusion. Residential proxies defeat geolocation-based detections such as impossible-travel alerts, and foreign intelligence entities continue to use them.
Technical Details
- Pawns.app is a partner of IPRoyal and appears to be a rebrand of IPRoyal Pawns. It offers pre-compiled command-line variants that accept username, password and device parameters at runtime, which makes silent installation on devices the operator does not own easy.
- The actor gained access to edge devices (including DVR/NVR) by exploiting vulnerabilities. The article text does not list the specific CVEs.
- In some cases the actor configured victim devices to accept SSH key authentication from the attacker as a backup access method.
- The binaries are not necessarily malware unless installed without consent.
- No IOCs are provided in the article text.
Remediation
- Detect residential proxy IPs in authentication logs, and scrutinize cases where multiple enterprise users authenticate from the same residential proxy IP.
- Detect deviations in authentication behavior beyond geolocation, such as mismatched device identifiers, session identifiers or User-Agent strings.
- Educate users about the risks of installing free applications and about keeping personal devices patched.
- Patch edge devices such as DVR/NVR and review them for unauthorized SSH keys.
- Use GreyNoise's free service to check whether an IP has interacted with its Global Observation Grid, a potential indicator of proxyjacking.