skynox7: Proxyjacking Edge Devices Into Residential Proxies

Summary: GreyNoise identified a malicious actor running a proxyjacking campaign that compromised at least 143 network edge devices across 34 countries, installing Pawns.app proxyware on behalf of the attacker using exploits against DVR/NVR brands including Hikvision and Dahua. In a separate case surfaced during a product demonstration, an organization found GreyNoise-labeled malicious IPs in its Entra ID sign-in logs that turned out to be residential proxies, with multiple users authenticating from one of the same residential IP addresses.
What you should know: Residential proxies defeat the geolocation and impossible-travel checks defenders rely on, so a login can look legitimate and local while the same IP is simultaneously proxying malicious traffic for an unrelated actor. With 143 devices already co-opted across 34 countries, the edge device on your network may be earning someone else money right now.

Read the original at GreyNoise Blog ↗