Your Hikvision or Dahua DVR is mining Pawns.app. You didn’t notice.

On October 15, GreyNoise published a global proxyjacking campaign that compromised at least 143 devices across 34 countries — turning routers, NAS boxes, and DVR/NVRs into bandwidth-resale nodes. The victim never clicks anything: the attacker exploits the vulnerability, installs Pawns.app, and keeps getting paid.[1][3]

The named CVEs are the ones you’d expect to be patched by now: CVE-2024-3272 and CVE-2024-3273 (D-Link ShareCenter NAS), CVE-2021-44228 (Ubiquiti UniFi Video NVR — Log4Shell, 5 years old, still active), and CVE-2025-31324 (SAP NetWeaver). Hikvision and Dahua DVR/NVR were also compromised, though the report doesn’t specify which CVEs were used.[1][3][6][7][8]

The procurement-defense datapoint: attackers configured SSH key authentication as a persistent access method. That means patching the original vulnerability does NOT close the backdoor.[1][3]

Every time I review a deployment for tv4agent, the metric that separates a defensible system from a decorative one isn’t resolution or FPS. It’s access persistence after patch. Three clauses your Q4 2026 CCTV RFP needs before approving any Hikvision / Dahua / Ubiquiti / D-Link DVR/NVR:

  1. SSH-key-rotation clause — factory firmware must NOT allow SSH key authentication by default; any persistent SSH key must be rotated or deleted on every factory reset / hardware reboot.
  2. Default-credentials deletion + mandatory credential rotation — no factory default credentials shipped; rotation mandatory on first connection (the initial vulnerability this campaign exploited).
  3. Outbound-traffic anomaly disclosure — firmware must monitor and report outbound traffic to known proxyjacking networks (Pawns.app and equivalents), with 24-hour customer notification.

P.D. How many of your DVR/NVRs still have factory-default passwords? How many accept SSH key access from an external IP? Today’s a good day to find out — because patching alone won’t save you.

The federal AA26-281A advisory issued by CISA + FBI + NSA + 7 allied agencies on October 8 had already categorized IoT devices — including CCTV and webcams — as a primary Flax Typhoon botnet vector.[2] GreyNoise Primary Research Blog Oct 15 2026 confirms that the current campaign extends that vector into the mass-market DVR/NVR segment.[4]

Editorial note: the “~60-70% LATAM market share in mid-market CCTV” figure referenced in news-digest-2026-10-16 on Hikvision + Dahua is an editorial thesis based on the GreyNoise coverage and the AA26-281A context; we have not verified a primary source with a direct percentage figure, so we mark this estimate as [unverified]. [unverified] The analytical frame is Pool #108 (Booz Allen OT-lab report Oct 11) + the Oct 8-15 newsjacking convergence: AA26-281A + Booz Allen + GreyNoise + Anthropic = the Q4 2026 pattern of “AI/IoT/OT attack surface as procurement-defense datapoint”.

📰 Source: GreyNoise + BleepingComputer Oct 15, 2026 [1][3]; CISA AA26-281A Flax Typhoon advisory Oct 8, 2026 [2]; NVD CVE database [5][6][7][8] (accessed 2026-10-16).

Sources

[1] https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth — BleepingComputer GreyNoise proxyjacking Oct 15 2026 [2] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a — CISA AA26-281A Flax Typhoon joint advisory Oct 8 2026 [3] https://blog.rankiteo.com/dahubidlihik1792095884-hikvision-d-link-ubiquiti-dahua-vulnerability-october-2026 — Rankiteo GreyNoise Hikvision/Dahua proxyjacking Oct 15 [4] https://www.greynoise.io/blog/global-proxyjacking-campaign-october-2026 — GreyNoise primary blog global proxyjacking Oct 15 2026 [5] https://nvd.nist.gov/vuln/detail/CVE-2021-44228 — NVD CVE-2021-44228 Log4Shell (5yr residual) [6] https://nvd.nist.gov/vuln/detail/CVE-2024-3272 — NVD CVE-2024-3272 D-Link ShareCenter [7] https://nvd.nist.gov/vuln/detail/CVE-2024-3273 — NVD CVE-2024-3273 D-Link ShareCenter [8] https://nvd.nist.gov/vuln/detail/CVE-2025-31324 — NVD CVE-2025-31324 SAP NetWeaver

Sources

[1] https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth — BleepingComputer GreyNoise proxyjacking Oct 15 2026 [2] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a — CISA AA26-281A Flax Typhoon joint advisory Oct 8 2026 [3] https://blog.rankiteo.com/dahubidlihik1792095884-hikvision-d-link-ubiquiti-dahua-vulnerability-october-2026 — Rankiteo GreyNoise HikVision/Dahua proxyjacking Oct 15 [4] https://www.greynoise.io/blog/global-proxyjacking-campaign-october-2026 — GreyNoise primary blog global proxyjacking Oct 15 2026 [5] https://nvd.nist.gov/vuln/detail/CVE-2021-44228 — NVD CVE-2021-44228 Log4Shell (5yr residual) [6] https://nvd.nist.gov/vuln/detail/CVE-2024-3272 — NVD CVE-2024-3272 D-Link ShareCenter [7] https://nvd.nist.gov/vuln/detail/CVE-2024-3273 — NVD CVE-2024-3273 D-Link ShareCenter [8] https://nvd.nist.gov/vuln/detail/CVE-2025-31324 — NVD CVE-2025-31324 SAP NetWeaver