FBI Warns: Hackers Hijack Home Routers for Illegal Bandwidth Resale

The Fraud Scheme & Investigation Details

A concerning trend has emerged where malicious actors are compromising home networking devices, specifically those from D-Link and Ubiquiti, to illicitly harness and resell internet bandwidth. This operation, dubbed 'proxyjacking,' involves exploiting known vulnerabilities in these devices to install unauthorized software. This software, often a legitimate bandwidth-sharing application like Pawns.app, is then used to route traffic from other users through the victim's internet connection without their knowledge or consent. The perpetrators profit by effectively creating a commercial residential proxy network, leveraging the stolen bandwidth for their own purposes. The FBI has previously issued warnings that such networks can be instrumental in facilitating large-scale credential stuffing attacks, where stolen usernames and passwords are used to gain unauthorized access to online accounts.

Scope of Victims & Financial Losses

• The campaign has been observed impacting devices in at least 34 countries.
• Threat intelligence indicates that over 143 compromised devices have been identified globally.
• Specific vulnerabilities exploited include CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer.
• Attacks have also targeted Hikvision and Dahua DVR/NVR devices, though specific vulnerabilities for these are not detailed.
• Attackers have been observed configuring SSH key authentication as a persistent access method, even after initial compromise.
• While direct financial losses for individual victims are not explicitly detailed, the scale of the operation and its potential use in further criminal activities represent a significant threat.

Key Takeaways & Prevention

This incident underscores the critical importance of securing home network devices. The exploitation of known vulnerabilities means that keeping firmware up-to-date is paramount. Users should regularly check for and apply firmware updates for their routers, NAS devices, and any other internet-facing hardware. Furthermore, employing strong, unique passwords for device administration interfaces and disabling unnecessary services can significantly reduce the attack surface. The FBI's warning about the use of these compromised networks for credential stuffing highlights the indirect risks to consumers, as their IP addresses could be associated with malicious activities. Consumers can utilize services like GreyNoise to check if their IP address is part of known proxy networks. Vigilance against downloading software from untrusted sources is also crucial, as seemingly innocuous applications can be used to enroll devices in these illicit networks. By taking proactive security measures, individuals can protect themselves from becoming unwitting participants in cybercriminal operations.