The campaign abuses known weaknesses in these devices to gain a foothold, after which the equipment is enrolled into the proxy network without the owners' knowledge. Because the activity blends into normal outbound traffic, affected organizations may not notice anything unusual until they investigate unexplained bandwidth consumption or suspicious connections.

Security teams should consider the following precautions:

• Review D-Link and Ubiquiti devices for unauthorized configuration changes or unexpected outbound traffic.
• Apply the latest firmware updates and replace hardware that no longer receives vendor support.
• Disable remote management and default credentials where possible, and restrict administrative access to trusted networks.
• Monitor network egress for connections to residential proxy infrastructure and investigate anomalies promptly.

Source: BleepingComputer

Has your organization audited its edge devices for signs of proxyjacking, or do you rely on vendor firmware updates alone?