Residential proxy exit nodes found on White House network (AS2650) via Infatica SDK on Windows 11 hosts
Layer3 Intel found six IP addresses on AS2650, the network of the Executive Office of the President, acting as exit nodes for 28 residential proxy services between October 5 and November 3. Its enumeration pipeline exited through the White House network 236 times. Anyone with a subscription to a public residential proxy service could route traffic through these addresses. Synthient attributes the traffic to Windows 11 machines running the InfaticaSDK. Layer3 Intel suggests the activity points to a person's device rather than guest Wi-Fi, because most of it falls between 5 p.m. and midnight Eastern Time.
Detalhes técnicos
- Synthient says the traffic comes from Windows 11 machines running the InfaticaSDK. Layer3 Intel's hypothesis is that the device of someone regularly on the White House network late into the evening is infected with a proxy SDK.
- Infatica is a Singapore-based proxy provider that advertises more than 45 million residential, mobile and datacenter IPs. Its founder, Vladimir Fomenko, also owns King Servers. Brian Krebs reports that King Servers hosted six of the eight IP addresses that Russian state-sponsored hackers used in the 2016 US election attacks. The article does not claim a link between this activity and any state actor.
- Layer3 Intel also reports residential proxy exits in remote territories. These include Saint Helena, Ascension and Tristan da Cunha (413 addresses and more than 32,000 observations), Antarctica, the Falklands, Pitcairn, Svalbard and Tokelau.
Remediação
The article gives no vendor or government response.
Linha do tempo
-
Residential proxy exit nodes found on White House network (AS2650) via Infatica SDK on Windows 11 hosts
ler a análise desta fonte ocultar
Layer3 Intel found six IP addresses on AS2650, the network of the Executive Office of the President, acting as exit nodes for 28 residential proxy services between October 5 and November 3. Its enumeration pipeline exited through the White House network 236 times. Anyone with a subscription to a public residential proxy service could route traffic through these addresses. Synthient attributes the traffic to Windows 11 machines running the InfaticaSDK. Layer3 Intel suggests the activity points to a person's device rather than guest Wi-Fi, because most of it falls between 5 p.m. and midnight Eastern Time.
Technical Details
- Synthient says the traffic comes from Windows 11 machines running the InfaticaSDK. Layer3 Intel's hypothesis is that the device of someone regularly on the White House network late into the evening is infected with a proxy SDK.
- Infatica is a Singapore-based proxy provider that advertises more than 45 million residential, mobile and datacenter IPs. Its founder, Vladimir Fomenko, also owns King Servers. Brian Krebs reports that King Servers hosted six of the eight IP addresses that Russian state-sponsored hackers used in the 2016 US election attacks. The article does not claim a link between this activity and any state actor.
- Layer3 Intel also reports residential proxy exits in remote territories. These include Saint Helena, Ascension and Tristan da Cunha (413 addresses and more than 32,000 observations), Antarctica, the Falklands, Pitcairn, Svalbard and Tokelau.
Remediation
The article gives no vendor or government response.