Proxyjacking Campaign Hijacks D-Link and Ubiquiti Devices to Resell Victims' Bandwidth

What Happened

According to a report from BleepingComputer, a proxyjacking campaign has compromised D-Link and Ubiquiti networking devices across 34 countries. The attackers are reportedly monetizing hijacked internet connections by enrolling the devices into a commercial residential proxy network, effectively reselling victims' bandwidth without their knowledge.

Why It Matters

Proxyjacking differs from cryptojacking in that it abuses network bandwidth and IP reputation rather than CPU cycles. For affected device owners, this can mean degraded connection performance, unexpected outbound traffic, and — more seriously — their IP address being used to route third-party traffic, potentially implicating them in activity they didn't initiate. The broad geographic spread (34 countries) suggests a widescale, opportunistic campaign targeting commonly deployed consumer and SMB networking gear rather than a narrowly targeted operation. Organizations and MSSPs managing fleets of edge devices, routers, or access points should treat this as a reminder that unmanaged or unpatched network hardware is an attractive, low-friction target for this kind of monetization.

What to Watch For / Do Now

• Inventory internet-facing D-Link and Ubiquiti devices and confirm firmware is current and default/weak credentials have been rotated.
• Audit device management interfaces for exposure to the internet; restrict admin access to trusted networks or VPN only.
• Watch for anomalous outbound connections from network devices to unfamiliar or proxy-service-associated IP ranges, especially sustained long-lived connections unrelated to normal device function.
• Monitor for unexpected spikes in bandwidth consumption or new processes/services running on devices that support them.
• Review DNS and NetFlow data for edge devices for connections to known residential-proxy or IoT botnet infrastructure.
• Where possible, segment IoT/network-edge devices from core infrastructure to limit blast radius if compromised.

Developing Story

Full technical details — including specific vulnerabilities exploited, the proxy network involved, and indicators of compromise — have not yet been disclosed in the available reporting. This is net-new intelligence and should be treated as preliminary; defenders should follow the original report for updates. Source: BleepingComputer.