GreyNoise has exposed an actor that quietly enrolled hacked storage boxes, video recorders and SAP systems into a paid residential proxy network. The research started with a handful of odd Entra ID sign-ins, and it shows why location-based login alerts can no longer be trusted on their own.
What happened
On 15 October 2026 the threat intelligence company GreyNoise published research on a campaign it attributes to an actor it calls skynox7. The operator broke into internet-facing edge devices using long-known vulnerabilities, then installed Pawns.app, a commercial bandwidth-sharing client, so that each compromised device became a node in a residential proxy network. GreyNoise counted at least 143 compromised devices across 34 countries.
The named targets were D-Link ShareCenter network storage (CVE-2024-3272 and CVE-2024-3273), Ubiquiti UniFi Video network video recorders through Log4Shell (CVE-2021-44228), and SAP NetWeaver Visual Composer (CVE-2025-31324). GreyNoise says the actor also appeared to go after Hikvision and Dahua recorders, although it does not report confirmed compromises of those brands. On some victims the attacker planted an SSH key of its own, a spare way back in should the proxy software be discovered and removed.
How the work began matters more to defenders than the device count. During a live product demonstration, an organisation spotted IP addresses that GreyNoise had labelled malicious sitting in its Microsoft Entra ID sign-in logs. The addresses looked residential and matched the places its staff would normally log in from. Further digging showed that several different users had authenticated from one of those residential addresses. GreyNoise says the organisation then confirmed a serious intrusion. It has not published details of that case.
The technical picture
Pawns.app is not malware in the conventional sense. It is marketed to people who want to earn small sums by letting a proxy provider route other customers’ traffic through their home connection. GreyNoise says it appears to be a rebrand of IPRoyal Pawns and supplies nodes to IPRoyal. The problem is the command-line builds, which accept an account name, password and device details at install time. That makes it trivial for an intruder to drop the client on a machine they have no right to and collect the payouts. GreyNoise calls this proxyjacking, and it published hashes of the binaries involved, an exploitation IP address (209.99.190.80) and the payout account linked to skynox7.
For the attacker, the money is only part of the attraction. Traffic leaving a hijacked NAS in a suburban office looks like any other broadband customer. Sign-in rules that rely on spotting hosting providers, commercial VPN ranges or impossible travel give an operator using these exits a free pass. GreyNoise makes a further point that is easy to miss: a residential IP can be proxying malicious traffic for a stranger while a perfectly legitimate employee logs in from the same household. A hit on a reputation feed is therefore a lead to investigate, not a verdict.
CVE-2025-31324 sits in the Visual Composer metadata upload function and lets unauthenticated attackers place executable files on the server. Its presence shows this was not only about consumer kit.
Why it matters for UK organisations
In April 2026 the NCSC, with 15 international partners, published advice on covert networks built from compromised routers and smart devices, which it said are believed to be used by most China-linked actors to hide where attacks come from. That advisory warned of “IOC extinction”, where indicators disappear almost as soon as they are discovered, and told organisations to map and baseline traffic from edge devices, particularly VPN and remote access connections. skynox7 looks like a criminal side business rather than state activity, but the method is the same, and anyone can rent the resulting exits.
For UK businesses the exposure is on two sides. Your own forgotten NAS, CCTV recorder or unpatched SAP instance could be carrying other people’s traffic, and the planted SSH key leaves an intruder with persistent access. At the same time, your identity platform may be accepting logins that arrive from a British broadband address and look entirely ordinary. In our experience, many Conditional Access policies in UK tenants still lean heavily on country and named-location rules, and those are exactly what this technique gets round.
Expert view
When we review cloud identity set-ups, the most common gap I see is an over-reliance on geography. Teams block sign-ins from abroad, alert on hosting ranges, then treat anything from a UK consumer ISP as low risk. Residential proxies turn that assumption upside down. The useful signal in the GreyNoise case was not where the login came from but who else was using the same address. Several unrelated staff members sharing one home broadband IP is rarely innocent unless they share a house.
The vulnerability list is also telling. None of these bugs is new. Log4Shell dates from 2021 and the D-Link issues from 2024, yet devices still sit on the internet waiting to be found. In my experience these boxes are often outside any patching programme because nobody remembers owning them: a storage unit installed by a former supplier, or a video recorder the facilities team manages. Asset discovery is dull, but it is the control most likely to have kept these devices out of the campaign.
Finally, removing the proxy client is not remediation. If an actor has written its own key into the device’s authorised keys, deleting the binary leaves the door open. Treat any affected device as compromised and rebuild or retire it.
What to do now
- Hunt in your sign-in logs. Query Entra ID (or your identity provider) for any single IP address used by several distinct accounts over a short period, and enrich the results with residential proxy and reputation data. Investigate every cluster you cannot explain.
- Look past location. Build detections around mismatched device identifiers, session tokens and User-Agent strings for the same user, as GreyNoise recommends, rather than relying on country or impossible travel rules.
- Tighten Conditional Access. Require phishing-resistant MFA and compliant or managed devices for access to sensitive applications, so a convincing IP address is never enough on its own (Cyber Essentials: user access control).
- Find your edge devices. Inventory internet-facing NAS units, NVRs and DVRs, and SAP NetWeaver servers. Remove direct internet exposure for management interfaces and anything that does not need to be public (Cyber Essentials: firewalls and secure configuration).
- Patch or retire. Apply vendor fixes for the four CVEs where they exist, and replace hardware that no longer receives updates (Cyber Essentials: security update management).
- Check for persistence. On suspect devices, review authorised SSH keys, unexpected accounts and unfamiliar processes. Search for the published Pawns.app hashes and for outbound connections to proxy services.
- Talk to staff. Explain why “earn on your internet” apps do not belong on any device used for work, including home kit used by remote workers.
Bottom line
skynox7 is a small operation by device count, but it highlights a growing blind spot. When attackers can rent a login path that looks like an ordinary UK broadband customer, geography stops being a useful control. SOC teams should hunt for shared IPs across accounts and device inconsistencies now, and close off the forgotten edge kit that supplies these networks in the first place.
