Proxyjacking Campaign Hits D-Link and Ubiquiti Devices Across 34 Countries

En bref

• Proxyjacking operators compromise D-Link and Ubiquiti devices.
• Stolen bandwidth is resold to monetize connections.
• Victims span 34 countries.
• No CVE identifiers are linked to this activity.
• K-12 networks with these devices are at risk.

Hackers are taking control of networking equipment from D-Link and Ubiquiti to turn them into proxy nodes. These proxyjacking groups then sell the compromised connections, effectively stealing bandwidth and profiting from the devices' internet access. The campaign has been observed across 34 nations. Because no specific CVE is tied to this activity, traditional vulnerability scanning may not flag the issue.

Any organization using D-Link or Ubiquiti hardware could be targeted, including K-12 schools and government offices. The attackers often don't need a software flaw; they exploit weak credentials or exposed management interfaces. Once inside, they quietly use the device's connection as a relay for other traffic, which can degrade performance and increase costs.

For schools, this matters because stolen bandwidth can disrupt online learning and mask further malicious activity. The absence of a CVE makes detection harder, as standard patch management won't address the misconfiguration or credential problem. Proxyjacking is a growing trend where attackers monetize compromised resources without deploying ransomware, making it stealthy and persistent.

The 34-country footprint suggests a broad, automated campaign. D-Link and Ubiquiti are common in small to mid-size networks, including schools. What to watch: monitor for unusual outbound traffic, especially to proxy or VPN services. Check device logs for unauthorized configuration changes. Keep firmware updated and change default passwords. Segment IoT and network devices from critical systems. If you suspect compromise, isolate and reimage the device.

À faire maintenant

1. Inventory all D-Link and Ubiquiti devices on your network.
2. Immediately change default credentials and disable remote management (WAN access).
3. Apply the latest firmware from the vendor, even without a CVE.
4. Monitor outbound traffic for unexpected proxy or VPN connections.
5. Segment network devices into a separate VLAN with strict firewall rules.
6. Review device logs for unauthorized changes or new accounts.
7. If compromise is suspected, factory reset and reconfigure devices.

Source originale

BleepingComputer