Hackers Hijack D-Link and Ubiquiti Devices to Resell Bandwidth
A proxyjacking campaign has compromised D-Link and Ubiquiti devices in 34 countries to resell stolen bandwidth via a commercial residential proxy network.
Why it matters
The widespread hijacking of IoT and home networking devices threatens network security by turning compromised devices into proxies that monetize victim internet connections without authorization.
SOC impact
Detect unexplained outbound proxy traffic originating from D-Link and Ubiquiti devices. Monitor network flows for signs of proxy reselling activity and review the deployment of these devices across the environment for unauthorized use.
Recommended actions
- Identify affected D-Link and Ubiquiti devices in the network
- Monitor outbound network traffic for proxy-like patterns
- Review device firmware and access logs for signs of compromise
- Investigate unusual bandwidth usage correlating with these devices
- Correlate threat intelligence from the BleepingComputer report for indicators of compromise
Executive Summary
A proxyjacking campaign targeting D-Link and Ubiquiti devices has been observed affecting systems in 34 countries. Attackers hijack these devices to resell their internet bandwidth through commercial residential proxy networks, effectively monetizing victim connections without their knowledge. This highlights the risk posed by unsecured IoT and home networking devices, which can serve as unwitting infrastructure for cybercriminal operations. Operational teams must focus on monitoring network telemetry and device activity to identify anomalous proxy use and mitigate impact.
SOC Impact
Detect unexplained outbound proxy traffic originating from D-Link and Ubiquiti devices. Monitor network flows for signs of proxy reselling activity and review the deployment of these devices across the environment for unauthorized use.
Network and Device Telemetry Validation
- Identify affected D-Link and Ubiquiti devices in the network
- Monitor outbound network traffic for proxy-like patterns
- Review device firmware and access logs for signs of compromise
- Investigate unusual bandwidth usage correlating with these devices
- Correlate threat intelligence from the BleepingComputer report for indicators of compromise
Why It Matters
The widespread hijacking of IoT and home networking devices threatens network security by turning compromised devices into proxies that monetize victim internet connections without authorization.