Residential proxy exit nodes found on White House network AS2650: 236 exits, Infatica and Rave.io SDKs implicated
Matéria consolidada. Reúne 8 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 06/11/2026 12:08; os links antigos trazem para cá.
Fontes: securityweek.com ↗ helpnetsecurity.com ↗ theregister.com ↗ infosecurity-magazine.com ↗ krebsonsecurity.com ↗
Layer3 Intel reported on November 4, 2026 that its enumeration pipeline exited through AS2650, the Executive Office of the President (White House) network, 236 times between October 5 and November 3, 2026. Six IP addresses were used on 26 of 30 days, and 28 residential proxy services could route traffic through them (infosecurity-magazine.com, helpnetsecurity.com, securityweek.com). Synthient and Spur independently flagged the addresses as proxy exits. Synthient first tied the traffic to Windows 11 hosts running Infatica, and later assessed with high confidence that the installed app is the Rave.io streaming app, which bundles 12 proxy SDKs (helpnetsecurity.com). Layer3 reports no confirmed compromise of White House systems, and its data shows the exits, not the device or person behind them. Layer3's retention goes back to July 10, so the activity may be months old (theregister.com). The activity stopped after Layer3 published its blog on Wednesday night, and the US State Department asked for the logs on Thursday, November 5. The White House had not commented at publication.
Detalhes técnicos
- Layer3 found the exits by chance while requesting ordinary global rotating access through public proxy services, using its newly launched Residential Proxy Observatory. It says anyone can buy the same access for a few dollars (infosecurity-magazine.com, krebsonsecurity.com).
- About half of the activity falls between 5 p.m. and midnight Eastern Time, with almost none in the early morning. Layer3 reads this as one regular user's device infected with a proxy SDK, not a guest Wi-Fi network (infosecurity-magazine.com, helpnetsecurity.com).
- Layer3's data does not show how many machines act as exit nodes, and the sources do not say how the SDK got onto the network (theregister.com).
- Synthient said on November 5 that it detects devices per session. It saw Windows 10 and 11 devices beaconing to Geonode, Infatica and Mellowtel (helpnetsecurity.com, theregister.com).
- Infatica is a Singapore-based proxy provider advertising more than 45 million IPs. Its founder, Vladimir Fomenko, also ran King Servers, which in 2016 hosted six of the eight IP addresses that Russian state security services used against election systems in Arizona and Illinois (krebsonsecurity.com, securityweek.com). SecurityWeek says it does not claim a link between this activity and any state actor.
- Likely cause: proxy SDKs bundled in "free" apps, where developers earn a small payment per installation (krebsonsecurity.com).
- Risk: exits let others route traffic through trusted government address space. A poorly secured SDK could let proxy buyers reach internal networks and move laterally. Synthient founder Ben Brundage said reseller access skips KYC checks (krebsonsecurity.com, theregister.com).
- Layer3 cited the Kimwolf botnet, documented by Synthient, which reached at least 2 million devices, mostly Android devices with exposed ADB, through residential proxy networks (infosecurity-magazine.com, helpnetsecurity.com).
- Background: a vulnerability in these services was mass exploited in late 2025 to probe local networks behind proxy endpoints. Dozens of services patched in January 2026 (krebsonsecurity.com).
- Spur (January 2026) found residential proxies in nearly 300 government networks, 318 utilities, 166 healthcare organizations and 141 banking and finance firms. Infoblox found 65% of its customers querying proxy-related domains (krebsonsecurity.com).
- The FBI warned in March 2026 that residential proxies are used to hide C2 traffic, run phishing and send spam (theregister.com).
- The Observatory also recorded exits in remote territories. Saint Helena, Ascension and Tristan da Cunha had 413 addresses and more than 32,000 observations. Antarctica had three observations, from a Cloudflare WARP address tied to McMurdo Station. The Falklands, Pitcairn, Svalbard and Tokelau were also reported (helpnetsecurity.com, securityweek.com).
Remediação
No source gives vendor or government remediation steps, and the White House has not responded. Layer3 backed up its raw logs and shared its findings with a US federal agency. It sent its logs to the State Department on request (infosecurity-magazine.com, theregister.com). Sensible measures drawn from the coverage are to inventory and block residential proxy SDKs and their domains on managed endpoints. Defenders should also restrict free apps, such as Rave.io, on devices that connect to sensitive networks (helpnetsecurity.com, krebsonsecurity.com).
Relatos divergentes
- Responsible software: krebsonsecurity.com and securityweek.com attribute the traffic to Infatica (the latter says the Infatica SDK on Windows 11). theregister.com says "likely Infatica". helpnetsecurity.com, the most recent source, reports Synthient's high-confidence assessment that the app is Rave.io, with 12 bundled SDKs including Infatica, Geonode and Mellowtel. The Rave.io attribution is the more recent and more specific. infosecurity-magazine.com does not name Infatica.
- Operating system: krebsonsecurity.com and securityweek.com cite Windows 11. theregister.com and helpnetsecurity.com cite Windows 10 and 11, reflecting Synthient's later statements.
- Activity end: krebsonsecurity.com and securityweek.com give a window ending November 3. infosecurity-magazine.com says activity was still seen on the evening of November 4. theregister.com says it stopped after the blog went live that night.
- Duration: the sources cite October 5 to November 3, but theregister.com reports that Layer3's data goes back to July 10 and suggests months of use.
Linha do tempo
-
Residential proxy exit nodes found on White House network (AS2650) via Infatica SDK on Windows 11 hosts
ler a análise desta fonte ocultar
Layer3 Intel found six IP addresses on AS2650, the network of the Executive Office of the President, acting as exit nodes for 28 residential proxy services between October 5 and November 3. Its enumeration pipeline exited through the White House network 236 times. Anyone with a subscription to a public residential proxy service could route traffic through these addresses. Synthient attributes the traffic to Windows 11 machines running the InfaticaSDK. Layer3 Intel suggests the activity points to a person's device rather than guest Wi-Fi, because most of it falls between 5 p.m. and midnight Eastern Time.
Technical Details
- Synthient says the traffic comes from Windows 11 machines running the InfaticaSDK. Layer3 Intel's hypothesis is that the device of someone regularly on the White House network late into the evening is infected with a proxy SDK.
- Infatica is a Singapore-based proxy provider that advertises more than 45 million residential, mobile and datacenter IPs. Its founder, Vladimir Fomenko, also owns King Servers. Brian Krebs reports that King Servers hosted six of the eight IP addresses that Russian state-sponsored hackers used in the 2016 US election attacks. The article does not claim a link between this activity and any state actor.
- Layer3 Intel also reports residential proxy exits in remote territories. These include Saint Helena, Ascension and Tristan da Cunha (413 addresses and more than 32,000 observations), Antarctica, the Falklands, Pitcairn, Svalbard and Tokelau.
Remediation
The article gives no vendor or government response.
-
Residential proxy traffic exits via White House network AS2650; Synthient links it to the Rave.io app with bundled proxy SDKs
Adds Synthient's high-confidence attribution of the activity to the Rave.io streaming app, which bundles 12 proxy SDKs. It also adds the Geonode and Mellowtel beaconing, the November 4 and 5 Synthient statements, researcher Matt Johansen's comment, and Layer3's findings in Saint Helena and Antarctica.
ler a análise desta fonte ocultar
Adds Synthient's high-confidence attribution of the activity to the Rave.io streaming app, which bundles 12 proxy SDKs. It also adds the Geonode and Mellowtel beaconing, the November 4 and 5 Synthient statements, researcher Matt Johansen's comment, and Layer3's findings in Saint Helena and Antarctica.
Layer3 Intel reported that its proxy enumeration pipeline exited through AS2650, the network of the Executive Office of the President, 236 times between October 5 and November 3, 2026. The exits came from six addresses on 26 of 30 days, and 28 residential proxy services offered the route. Synthient said it detected Windows 10 and 11 devices beaconing to Geonode, Infatica and Mellowtel. It assessed with high confidence that the installed app is Rave.io, a shared streaming app that bundles 12 proxy SDKs. Layer3's data shows only the exits, not the device or the person. It reported no confirmed compromise of White House systems.
Technical Details
- About half of the traffic falls between 5 p.m. and midnight Eastern time, and almost none in the early morning. Layer3 reads this as one regular user's device infected with a proxy SDK.
- Layer3 did not target the network. It saw the exits while requesting global rotating access in its Residential Proxy Observatory, and other detection services independently flag the addresses as proxy exits.
- Synthient first claimed on November 4 that staffers were running Windows 11 with InfaticaSDK. On November 5 it said it detects devices per session.
- Layer3 cited the Kimwolf botnet, documented by Synthient, which reached at least 2 million devices, mostly Android with exposed ADB, through residential proxy networks. It warned that a flaw in an SDK on this network could let proxy buyers reach internal systems.
- The Observatory also recorded 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha. It recorded three observations in Antarctica, from a Cloudflare WARP address tied to McMurdo Station.
Remediation
The article gives no remediation steps. Sensible measures are to block residential proxy SDKs and domains on managed endpoints and to restrict free apps such as Rave on devices that connect to sensitive networks.
-
Residential proxy exits (likely Infatica SDK) found on White House network; State Department requests Layer3 logs
The Register adds that Layer3's retention reaches back to July 10, so the activity may be months old. Synthient now cites multiple Windows 10 and 11 devices. Residential proxy activity stopped after the Layer3 blog went live on Wednesday night. The State Department requested Layer3's logs on Thursday, and Layer3 sent them. The article also cites the FBI's March 2026 bulletin on residential proxies.
ler a análise desta fonte ocultar
The Register adds that Layer3's retention reaches back to July 10, so the activity may be months old. Synthient now cites multiple Windows 10 and 11 devices. Residential proxy activity stopped after the Layer3 blog went live on Wednesday night. The State Department requested Layer3's logs on Thursday, and Layer3 sent them. The article also cites the FBI's March 2026 bulletin on residential proxies.
Layer3 Intel reported that devices on the White House network appear to act as residential proxy exit nodes. It found the activity through its new Residential Proxy Observatory. Layer3 logged 28 distinct residential proxy services exiting into the network almost daily between October 5 and November 3, 2026, with 236 separate exits. Other residential proxy detection services logged the same activity. Synthient believes several Windows 10 and 11 machines run the Infatica SDK. The evening timing (5 pm to midnight) points to a staff device rather than a guest. The article does not say how the SDK got there, and the White House did not respond to questions.
Technical Details
- Layer3's data retention goes back to July 10, and its founder Sergiy Usatyuk said continuous activity over months suggests the White House IPs have been used by residential proxy networks for some time (theregister.com).
- Layer3 notes that poorly secured proxy SDKs have allowed internal network access and lateral movement in past research. It warns that buyers of proxy access could reach internal systems if an SDK on this network has the same flaw (theregister.com).
- Layer3's data does not show how many machines are acting as exit nodes (theregister.com).
- The FBI warned in March 2026 that residential proxies are used to hide C2 traffic, run phishing and send spam. It named malware, illicit SDK partnerships and VPNs with hidden terms as ways devices are turned into nodes (theregister.com).
Remediation
The article lists no formal remediation steps. Usatyuk said the last activity was seen Wednesday night, hours after Layer3's blog went live, and has since stopped. The US State Department asked Layer3 for its logs on Thursday morning, and Usatyuk said he sent them (theregister.com).
-
Residential proxy traffic exits via White House network AS2650 in 236 observations, Layer3 Intel reports
Layer3 Intel's own research (Infosecurity Magazine, Nov 5) adds a first-hand account: it found the exits by chance, Spur and Synthient independently confirmed them, and the evening pattern suggests a single infected device. Layer3 reports no compromise of White House systems. Activity was still seen on November 4. Layer3 backed up the raw logs and shared its findings with a US federal agency. It also cites the Kimwolf botnet (at least two million devices) as an example of how proxy SDKs spread. This article does not name Infatica.
ler a análise desta fonte ocultar
Layer3 Intel's own research (Infosecurity Magazine, Nov 5) adds a first-hand account: it found the exits by chance, Spur and Synthient independently confirmed them, and the evening pattern suggests a single infected device. Layer3 reports no compromise of White House systems. Activity was still seen on November 4. Layer3 backed up the raw logs and shared its findings with a US federal agency. It also cites the Kimwolf botnet (at least two million devices) as an example of how proxy SDKs spread. This article does not name Infatica.
Layer3 Intel, a New York-based residential proxy detection firm, reported on November 4 that residential proxy traffic exited through the Executive Office of the President network (AS2650) 236 times between October 5 and November 3, 2026. 28 residential proxy services could route traffic through six addresses, and exits were recorded on 26 of the 30 days. Layer3 cross-checked the addresses against public lookups from Spur and Synthient, which independently flagged them as residential proxy exits. About half of the activity fell between 5pm and midnight Eastern Time, which Layer3 says points to one person's device infected with a proxy SDK, not a guest Wi-Fi network. Layer3 reported no compromise of White House systems, and the White House had not commented at publication.
Technical Details
- Layer3 found the exits by chance while requesting ordinary global rotating access through public proxy services. It said anyone can get the same exits for a few dollars. It saw them in its newly launched Residential Proxy Observatory (Layer3 Intel via infosecurity-magazine.com).
- Layer3 stresses that its data shows the exits, not the device or person behind them.
- Layer3 founder Sergiy Usatyuk said the most recent activity was recorded on the evening of November 4.
- Risk: a poorly secured proxy SDK can let buyers of proxy access reach internal networks and move laterally. Layer3 cited Synthient research on the Kimwolf botnet, which reached at least two million devices, mostly Android devices with an exposed ADB service, through residential proxy networks.
Remediation
The article gives no remediation steps. Layer3 said it backed up the raw logs and shared its findings with a US federal agency. Defenders should inventory and block residential proxy SDKs and their domains on managed endpoints.
-
Residential proxy software (Infatica and 27 other services) found exiting through White House Executive Office network AS2650
ler a análise desta fonte ocultar
Layer3 Intel and Synthient reported that residential proxy nodes were beaconing from the Executive Office of the President network (AS2650). The activity was relatively persistent from October 5 to November 3, 2026. Layer3 counted 236 exits from the White House network over that period. Synthient tied the activity to multiple Windows 11 installations of Infatica, a proxy program often bundled into "free" apps. Infatica's founder, Vladimir Fomenko, ran the hosting firm King Servers. In 2016 that firm hosted six of the eight IP addresses Russian state security services used against election systems in Arizona and Illinois. The White House had not responded to a request for comment. This summary relies on the single KrebsOnSecurity article. No vendor advisory or other primary source was checked.
Technical Details
- Layer3 Intel saw the exits come from six IP addresses on 26 of 30 days, mostly between 5 p.m. and midnight.
- Layer3 found 28 separate residential proxy services able to exit through the network. It said anyone can buy this access for a few dollars and that it found the exits by chance.
- The likely cause is proxy SDKs embedded in apps that staff installed on work or personal devices. Developers earn a small payment per installation.
- Risk: proxy exits let others route traffic through trusted government address space, and the proxy software exposes local networks. Synthient founder Ben Brundage said reseller access skips KYC checks.
- Background cited in the article: a vulnerability in these services was mass exploited in late 2025 to probe local networks behind proxy endpoints. Dozens of services patched in January 2026 after Synthient showed it could be abused to take over devices on those networks.
- Spur (January 2026) found residential proxies in nearly 300 government networks, 318 utilities, 166 healthcare organizations and 141 banking and finance firms. Infoblox found 65% of its customers querying proxy-related domains.
Remediation
The article gives no remediation steps. Defenders should inventory and block residential proxy SDKs and domains on managed endpoints. They should also restrict installation of free apps on devices that connect to sensitive networks.