Hackers Hijack D-Link and Ubiquiti Devices to Resell Stolen Bandwidth
Hackers have hijacked D-Link and Ubiquiti networking devices to resell victims' internet connections through a commercial residential proxy network. This proxyjacking campaign has impacted devices across 34 countries, effectively monetizing the stolen bandwidth of unsuspecting users. The operation turns everyday home and small-business routers into nodes for a global data resale market.
Immediate Facts and Key Actors
The campaign specifically targets D-Link and Ubiquiti hardware, leveraging vulnerabilities in these widely adopted networking products. Hackers gain control of the devices and redirect their traffic through a proxy network, allowing them to sell the resulting IP addresses to third parties. This process monetizes the victims' internet connections without their knowledge or consent. The scale of the operation is evident in its reach, spanning 34 countries globally.
Ubiquiti, a major player in the networking space, provides hardware often used in both residential and small business environments. D-Link is another significant manufacturer of consumer and prosumer networking gear. The choice of these two brands suggests a focus on devices with high market penetration and potentially weaker default security configurations. The commercial nature of the proxy network indicates that the stolen bandwidth is being sold as a service, likely to businesses needing large pools of residential IP addresses for web scraping, ad verification, or content distribution.
The impact on individual users is often invisible. Victims may not notice a drop in their internet speed or an increase in their data usage, as the hijacked bandwidth is typically a small fraction of their total connection. However, the cumulative effect across millions of devices can be substantial for the proxy network operators. The commercialization of residential bandwidth creates a new revenue stream for hackers, incentivizing them to continue targeting these devices. This shift from simple data theft to infrastructure monetization represents a significant evolution in cybercrime tactics.
The geographic spread across 34 countries highlights the global nature of this threat. It is not limited to a specific region or market, indicating that the vulnerability is widespread and not dependent on local network conditions. The use of residential proxies is particularly valuable because these IP addresses are less likely to be blocked by websites compared to data center IPs. This makes the stolen bandwidth from D-Link and Ubiquiti devices highly desirable in the commercial proxy market.
The commercial stakes are clear. As more devices are hijacked, the supply of residential IP addresses increases, potentially driving down the price of these services. This could make proxy-based attacks more affordable for a wider range of cybercriminals. The ease of hijacking these devices also lowers the barrier to entry for new actors looking to enter the proxy resale market. The long-term consequence is a larger, more resilient underground economy built on stolen consumer infrastructure.
See Also
Read the full article on Network Herald
Full Article →