No Encryption, No Destruction, No Ransom: How Proxyjacking Turns Home Routers into a Commodity
According to a report by BleepingComputer, security researchers have uncovered a "proxyjacking" campaign targeting D-Link and Ubiquiti network devices, with compromised units spread across 34 countries. After compromising routers and networking equipment, the attackers enroll the victims' internet connections into a commercial residential proxy network and resell the bandwidth for profit — all while the victims remain unaware that they are footing the bill for the traffic, suffering reputational damage to their IP addresses, and potentially carrying legal risk.
The fundamental difference between this type of attack and ransomware or data theft lies in its target: the attackers are not after the data on the device, but rather the "clean" residential or commercial IP connection the device provides. The hijacked bandwidth is bundled into proxy networks and sold to buyers who use it to bypass geographic restrictions, conduct large-scale scraping, or carry out other anonymous activities.
What Is Confirmed — and What Remains Unclear
Researchers have confirmed that the affected vendors include D-Link and Ubiquiti, and that the campaign spans 34 countries. However, the research team has not published a definitive list of affected models, nor have they disclosed specific vulnerability identifiers (CVEs) or a full attack chain.
What is currently confirmed is the pattern of attack — including default or weak credentials, web-based management interfaces exposed to the internet (WAN side), and firmware that has not been updated for an extended period. These three are the most common entry points for this type of device compromise, but the report does not confirm which specific vulnerability or known CVE was exploited in this campaign. Administrators should not assume their devices are safe "just because their model was not named."
Analysis: Why Hong Kong SMEs and Home Offices Deserve Attention
Note: The following is this publication's own analysis of regional risk, inferred from the attack patterns described in the original report. It is not a direct conclusion of the BleepingComputer article.
The campaign targets stable, continuously available broadband IP addresses — precisely what a large number of Hong Kong SMEs, work-from-home (WFH) employees, and co-working spaces provide. For proxy network operators, residential or commercial IP addresses from Asian hub cities like Hong Kong carry real market value: they are geographically accurate, can access localized content, and are relatively scarce. Put simply, a conservatively configured home or small-office router used only for web browsing and cloud services can just as easily become an asset worth targeting.
Another locally relevant factor is device lifespan. Many SMEs and home networks still run older models that no longer receive security updates, or devices that have retained their factory-default settings for years. Once such devices are enrolled into a proxy network, the compromise often goes undetected until bandwidth bills spike, the IP address gets blocked by external services, or law enforcement comes knocking — by which point the cost of remediation far exceeds the cost of prevention.
Checklist and Defensive Recommendations
-
Verify model and firmware version: Log in to the management interface of your D-Link or Ubiquiti device, check the current firmware version, and compare it against the latest official stable release. If the device has reached end-of-life (EOL) status and no longer receives security patches, plan for replacement — devices that no longer receive updates represent an added risk factor, even if the specific model was not named in this report.
-
Change all default and weak passwords: This includes administrator accounts, wireless network passwords, and ISP dial-up credentials. Use long, unique passwords and enable multi-factor authentication where the device supports it.
-
Close management interfaces exposed to the public internet and monitor outbound traffic: Disable WAN-side management access, UPnP, and any unnecessary remote management features. If remote management is required, use a VPN to enter the internal network first. Additionally, use NetFlow export, built-in router traffic statistics, or simple bandwidth monitoring tools to watch for sustained upload traffic during off-hours, and regularly review NAT/session records for large numbers of connections to unfamiliar IPs or ports commonly associated with proxy service providers. The telltale sign of proxyjacking is a device that maintains steady, long-running bidirectional or upload connections while sitting idle.
Conclusion
Proxyjacking is difficult to detect precisely because it doesn't break anything — it simply and silently turns your network connection into someone else's commodity. For Hong Kong's SMEs and home offices, the most effective defense is not expensive equipment, but three basic disciplines: keep firmware updated, replace default passwords, and close management interfaces exposed to the public internet. Combined with ongoing monitoring of outbound traffic, these steps can catch a device in the early stages of being enrolled into a proxy network.
Source: BleepingComputer (original report via link at top of article). This article is an explainer on security risk; the scope of the attack and technical details are subject to the original report and vendor advisories.
不加密、不破壞、不索取贖金：Proxyjacking 如何把家用路由器變成商品
據 BleepingComputer 報導，安全研究人員近日發現一場針對 D-Link 與 Ubiquiti 網絡設備的「proxyjacking」（代理劫持）攻擊活動，受影響裝置遍布全球 34 個國家。攻擊者入侵路由器與網絡設備後，將受害者的互聯網連接加入商業化住宅代理（residential proxy）網絡並對外轉售頻寬以牟利——而受害者則在毫不知情下為這批流量買單、蒙受 IP 聲譽受損，並可能招致法律風險。
這類攻擊與勒索軟件或資料竊取的根本差別在於目標：攻擊者要的不是設備中的數據，而是設備本身所提供的「乾淨」住宅或商用 IP 連接。被劫持的頻寬會被打包到代理網絡中出售，供買家用於繞過地域限制、大規模抓取或其他匿名活動。
已確認範圍與尚未明朗之處
研究人員確認受影響廠牌包括 D-Link 與 Ubiquiti，並指出攻擊活動橫跨 34 個國家。不過，研究團隊並未公布一份完整而確定的受影響型號清單，也未公開具體的漏洞編號（CVE）或完整攻擊鏈。
目前可確認的是攻擊模式，包括預設或弱密碼、暴露在網際網路（WAN）側的管理後台，以及長期未更新的韌體——這三者是此類設備入侵中最常見的切入方式，但報導並未證實本次攻擊具體利用了哪一個漏洞或已知 CVE。管理員不應假設自己的設備「因為型號未被點名而安全」。
分析：為何香港中小企與家庭辦公室值得關注
註： 以下為本刊編輯根據原報導所述攻擊模式推斷的地區性風險分析，並非 BleepingComputer 原文的直接結論。
這類攻擊的目標是持續穩定的寬頻 IP，而這正是香港大量中小企、在家辦公（WFH）員工及共享辦公室所具備的特徵。對代理網絡營運方而言，來自香港等亞洲樞紐城市的住宅或商用 IP 具有實際市場價值——地理定位準確、可存取本地化內容，且相對稀有。換言之，一台配置保守、只用來上網及連接雲端服務的家用或小型辦公室路由器，同樣可能成為被鎖定的資產。
另一個本地相關因素是設備壽命。不少中小企與家庭網絡仍在使用已停止安全更新的舊型號，或長期未修改出廠預設設定。這類設備一旦被納入代理網絡，往往要等到頻寬帳單異常、IP 被外部服務封鎖，甚至執法機構上門調查時才被察覺——而此時補救成本已遠高於預防。
檢查與防護建議
-
核對型號與韌體版本：登入 D-Link 或 Ubiquiti 裝置的管理介面，確認當前韌體版本，並與官方最新穩定版本比對。若設備已到達產品生命週期終點（EOL），官方不再提供安全修補，應規劃汰換——已停止更新的設備屬額外風險因素，即使型號未在本次報導中被點名也一樣。
-
更換所有預設與弱密碼：包括管理員帳戶、無線網絡密碼及 ISP 撥號憑證，改用長度足夠且唯一的密碼，並啟用多因素認證（如設備支援）。
-
關閉面向公網的管理介面，並監察對外流量：停用 WAN 側的管理訪問、UPnP 及不必要的遠端管理功能；如需遠端管理，改用 VPN 進入內網後再操作。同時以 NetFlow 匯出、路由器內建的流量統計或簡單的頻寬監控工具，觀察非辦公時段的持續性上傳流量，並定期檢視 NAT／連線工作階段記錄，留意大量連往陌生 IP 或代理服務商常見端口的連線。代理劫持的典型特徵，是裝置閒置時仍有穩定、長期的雙向或上傳連線。
結語
Proxyjacking 之所以難以察覺，在於它不破壞任何東西——只是默默地把你的網絡連接變成別人的商品。對香港的中小企與家庭辦公室而言，最有效的防線並非昂貴設備，而是三件基本功：更新韌體、換掉預設密碼、關閉暴露在公網上的管理介面；再配合對外流量的持續監察，就能在設備被納入代理網絡的早期階段及時發現。
資料來源：BleepingComputer（原始報導見文首連結）。本文為資安風險解說，涉及之攻擊範圍與技術細節以原報導及廠商公告為準。