skynox7: Proxyjacking Edge Devices Into Residential Proxies

Adversarial groups utilize diverse methods, including commercial VPNs and VPS providers, to obscure their true public internet protocol (IP) addresses for attribution evasion. The rise of residential proxies complicates detection because they mimic legitimate user activity patterns. An investigation utilizing GreyNoise identified both a stealthy intrusion involving residential proxies and an actor conducting a proxyjacking campaign. Initial sign-in logs flagged malicious residential IPs that appeared geographically plausible, leading to the assessment that compromised devices might be participating in proxy networks without the users' knowledge. The case advanced when multiple enterprise users were found authenticating from a single residential IP address, which validated the hypothesis of underlying proxy abuse and led to confirmation of a serious intrusion.
Proxy networks pose significant defensive challenges, particularly with residential proxies, as they bypass geolocation-based detection logic like "Impossible Travel." Furthermore, a distinction is drawn between voluntary bandwidth sharing ("Pawning Your Bandwidth") via software participants and the criminal act of proxyjacking, where attackers force devices to participate to monetize their bandwidth. Attackers have been observed using exploits on vulnerable network edge devices, such as DVR/NVRs from brands like Hikvision and Dahua, to install malicious proxyware.

Adversaries use various nodes and services to obfuscate IP addresses, including commercial VPNs and VPS providers.
GreyNoise helped identify a stealthy intrusion involving residential proxies in one organization.
A separate malicious cyber actor was revealed conducting a proxyjacking campaign.
An investigation involved Entra ID sign-in logs showing GreyNoise-labeled malicious residential IPs that matched expected geolocation.
The initial finding suggested compromised devices might be part of a proxy network with or without user awareness.
Subsequent investigation revealed multiple users authenticating from the same residential IP address.
Proxy networks challenge defenses relying on incongruent geolocation detection (e.g., "Impossible Travel").
"Pawning Your Bandwidth" describes voluntary software installation where participants earn passive income using their bandwidth.
Proxyjacking is defined as an MCA forcing victim devices into proxy networks for monetization.
GreyNoise identified an MCA installing Pawns.app on at least 143 devices in 34 countries via device exploits.
The targeted DVR/NVR brands included Hikvision and Dahua.

The narrative surrounding infrastructure obfuscation reveals a tension between legitimate participant economic incentives and criminal exploitation. The voluntary model of "pawning bandwidth"—where users willingly turn their devices into passive income nodes—provides a systemic pathway that criminals exploit through "proxyjacking." This duality forces defenders to shift from simply identifying *bad* IPs to understanding the *state* of an IP's legitimacy or forced compromise. When residential proxies are involved, traditional defensive assumptions break down; the seemingly benign signal (a login from a plausible location) can mask profound underlying systemic risks.
The implication here is that defenses must become behaviorally rich rather than purely geographic. The single point where detection moved from "this could be anything" to "this is seriously bad"—the observation of multiple distinct user sessions originating from one singular residential IP—illustrates the necessity of observing statistical anomalies over individual data points. This suggests that resilience against evasion relies on correlation, not isolation.
The underlying paradigm echoes historical patterns in digital infrastructure exploitation: weaponizing the supply chain or exploiting low-security endpoints to gain broad reach for illicit activity. The ease with which adversaries can install remote software via vulnerable embedded devices shows a failure of boundary security at the hardware/firmware level, an area often marginalized by traditional network perimeter defense thinking.
Patterns detected