Residential proxy exits (Infatica SDK suspected) traced to White House network AS2650; no compromise confirmed
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 05/11/2026 20:10; os links antigos trazem para cá.
Fontes: theregister.com ↗ infosecurity-magazine.com ↗ krebsonsecurity.com ↗
Layer3 Intel, with the proxy-tracking firm Synthient, found residential proxy software beaconing from the address block of the Executive Office of the President (AS2650). Third parties could therefore rent and route traffic through White House IP addresses. Layer3 Intel recorded 236 proxy exits between October 5 and November 3, 2026, across 28 separate residential proxy services (krebsonsecurity.com, infosecurity-magazine.com, theregister.com). Synthient attributes part of the activity to the Infatica proxy SDK on Windows devices, a product founded by Russian national Vladimir Fomenko. Layer3 Intel has not found evidence that White House systems were compromised (infosecurity-magazine.com). It has shared its logs with a US federal agency, identified by The Register as the US State Department. The White House has not commented publicly. Infosecurity Magazine reports the latest activity on the evening of November 4, while The Register (the later source) says the most recent activity has since stopped.
Detalhes técnicos
- Scope: The exits came from six IP addresses inside AS2650, on 26 of the 30 days (krebsonsecurity.com). Layer3 Intel found the activity by chance while requesting global rotating residential proxy access. It did not target the network (krebsonsecurity.com). The Register says the finding came from its newly launched Residential Proxy Observatory.
- Public access: Anyone can obtain this access by paying a few dollars to a public residential proxy service (krebsonsecurity.com).
- Corroboration: Layer3 Intel cross-checked the addresses against public lookup pages from Spur and Synthient, which independently confirmed them as residential proxy exits (infosecurity-magazine.com).
- Timing: Most activity fell between 5 p.m. and midnight, and about half occurred in that window Eastern Time, with almost none in the early morning. Layer3 Intel reads this as one device used regularly by a person in the evening, not public guest Wi-Fi, and possibly infected with a proxy SDK (infosecurity-magazine.com, theregister.com).
- Infatica: Synthient tied the activity to Windows installations of Infatica, a proxy program often bundled into "free" mobile and desktop apps (krebsonsecurity.com). Infatica is a commercial SDK that lets developers monetize users' connections by turning devices into proxy exit nodes (theregister.com).
- Other services: Infatica was not the only service involved. Synthient also traced some activity to a bundled-proxy streaming app called Rave.io (cybernews.com and daily.dev, as cited by theregister.com).
- Historical exposure: Layer3 Intel's data retention only goes back to July 10. Given the continuous activity and the corroboration, it assesses that White House IPs have likely been used by residential proxy networks for some time (theregister.com).
- Fomenko and King Servers: Fomenko's hosting firm King Servers was previously linked to infrastructure used in the 2016 compromise of Arizona and Illinois election systems. The reporting does not tie this incident to that activity (krebsonsecurity.com, theregister.com).
- Risk: Layer3 Intel warned that poorly secured proxy SDKs can allow internal network access and lateral movement. If the SDK on the White House network had such a flaw, anyone buying proxy access could reach internal systems (infosecurity-magazine.com, theregister.com). No such flaw has been shown here.
- Precedent: Synthient research on the Kimwolf botnet found at least two million devices, mostly Android devices with exposed ADB, reached through residential proxy networks (infosecurity-magazine.com). In late 2025 criminals mass-exploited a widespread flaw in these services to probe the local networks behind proxy endpoints, and in January 2026 dozens of proxy services had to patch (krebsonsecurity.com).
- Abuse of residential proxies: The FBI warned in a March bulletin that residential proxies are commonly abused to hide command-and-control infrastructure, run phishing, send spam and disguise malicious traffic (theregister.com).
Remediação
No vulnerability or fix has been published, because this is an operational security finding and not a software flaw. The White House has issued no public statement and no remediation by it has been reported (theregister.com, infosecurity-magazine.com). The State Department is reviewing the logs Layer3 Intel provided (theregister.com). The Register advises organizations to audit endpoints for unauthorized proxy SDKs bundled in free consumer apps and to monitor sensitive networks for anomalous outbound beaconing.
Relatos divergentes
- Operating system: Krebs on Security says Synthient saw multiple Windows 11 installations of Infatica. The Register, the later source, says Synthient believes multiple Windows 10 and Windows 11 devices likely have it.
- Current status: Infosecurity Magazine reports activity as recent as the evening of November 4, with Layer3's founder Sergiy Usatyuk saying "hopefully, it stops soon". The Register, published later, says the most recent activity has stopped.
- Agency contact: Infosecurity Magazine says only that findings were shared with a US federal agency. The Register names the US State Department as having requested the logs.
- Infection claim: The Register presents the staffer's infected device with a compromised proxy SDK as Layer3 Intel's interpretation. Layer3 Intel's own statement, as reported by Infosecurity Magazine, is only that the device is "possibly" infected. Neither source confirms the host or the SDK flaw.
Linha do tempo
-
White House network (AS2650) devices found serving as residential proxy exit nodes for a month
ler a análise desta fonte ocultar
Security firm Layer3 Intel reported that devices associated with the White House network (autonomous system AS2650, registered to the Executive Office of the President) have been acting as residential proxy exit nodes, a finding made via its newly launched Residential Proxy Observatory. Layer3 Intel found 28 distinct residential proxy services exiting through the network nearly every day between October 5 and November 3, 2026, totaling 236 separate exits, with other residential proxy detection services independently corroborating the data. Most activity occurred in the evening, White House time, between 5 pm and midnight, which Layer3 Intel interprets as a staffer's infected device rather than guest Wi-Fi traffic, likely caused by a compromised proxy SDK. Security firm Synthient said it believes multiple Windows 10 and Windows 11 devices on the network likely have the Infatica proxy SDK installed. The US State Department contacted Layer3 Intel to request a copy of its logs, and the most recently observed activity has since stopped, though the White House itself did not respond to requests for comment.
Technical Details
Residential proxy networks route third-party traffic through residential IP addresses rather than datacenter infrastructure, which the FBI warned in a March bulletin is commonly abused to conceal command-and-control infrastructure, conduct phishing, send spam, and disguise malicious traffic. Infatica is a commercial SDK that lets app developers monetize users' internet connections by turning devices into proxy exit nodes; Layer3 Intel warned that "poorly secured proxy SDKs can allow internal network access and lateral movement," meaning a flaw in such software on the White House network could let anyone buying proxy access reach internal systems. Layer3 Intel's data retention only goes back to July 10, but given the continuous activity seen and independent corroboration, the firm assesses White House IPs have likely been used by residential proxy networks for some time (layer3intel.com, via theregister.com). Separate reporting identified the proxy exits as originating from six distinct internet addresses within AS2650 and noted that Infatica was founded by Vladimir Fomenko, whose hosting firm King Servers was linked to IP addresses used in 2016 Russian state-backed intrusions into Arizona and Illinois election systems, and that Synthient also traced some activity to a bundled-proxy streaming app called Rave.io (cybernews.com, daily.dev).
Remediation
No vulnerability or fix has been published, as this is an operational security finding rather than a software flaw disclosure; the White House has not issued a public statement, and the State Department is reviewing the logs Layer3 Intel provided. Organizations should audit endpoints for unauthorized proxy SDKs bundled in free consumer applications, monitor for anomalous outbound beaconing on sensitive networks, and treat unexplained residential-proxy-like traffic from staff devices as a potential indicator of compromise.
-
Residential Proxy Exit Traffic Traced to White House Network (AS2650), No Compromise Confirmed
This follow-up article adds that Layer3 Intel cross-checked the suspicious White House IP addresses against public lookup pages from Spur and Synthient, which independently confirmed them as residential proxy exits. It also reports that Layer3 founder Sergiy Usatyuk told Infosecurity Magazine the most recent proxy activity was recorded on the evening of November 4, 2026, and that Layer3 has backed up the raw logs and shared its findings with a US federal agency while explicitly stating it has not found evidence of a compromise of White House systems. As an illustration of the risk posed by vulnerable proxy SDKs, the article cites Synthient research on the Kimwolf botnet, which reached at least two million devices, mostly Android devices with exposed ADB services, through residential proxy networks.
ler a análise desta fonte ocultar
This follow-up article adds that Layer3 Intel cross-checked the suspicious White House IP addresses against public lookup pages from Spur and Synthient, which independently confirmed them as residential proxy exits. It also reports that Layer3 founder Sergiy Usatyuk told Infosecurity Magazine the most recent proxy activity was recorded on the evening of November 4, 2026, and that Layer3 has backed up the raw logs and shared its findings with a US federal agency while explicitly stating it has not found evidence of a compromise of White House systems. As an illustration of the risk posed by vulnerable proxy SDKs, the article cites Synthient research on the Kimwolf botnet, which reached at least two million devices, mostly Android devices with exposed ADB services, through residential proxy networks.
Layer3 Intel, a residential proxy detection firm, published research on November 4, 2026 showing that residential proxy traffic exited through the White House network 236 times over a 30-day period between October 5 and November 3. The traffic used six IP addresses within AS2650, the autonomous system registered to the Executive Office of the President, and was routed by 28 separate residential proxy services. Layer3 cross-checked the addresses against public lookup pages from proxy detection services Spur and Synthient, which independently confirmed the addresses as residential proxy exits. The firm said it found the activity by chance while requesting ordinary rotating residential proxy access, and emphasized it has not confirmed any compromise of White House systems, though it flagged risk from vulnerable proxy SDKs.
Technical Details
About half of the proxy exit activity occurred between 5pm and midnight Eastern Time, with almost none in the early morning, a pattern Layer3 said suggests a single device used by a person regularly on the network in the evening rather than a public guest Wi-Fi network, possibly infected with a proxy software development kit (SDK). Layer3 founder Sergiy Usatyuk told Infosecurity Magazine that the most recent activity was recorded on the evening of November 4, adding "hopefully, it stops soon". Layer3 said it has backed up the raw logs of the activity and shared its findings with a US federal agency, but has not reported any compromise of White House systems. The firm cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge (ADB) service, through residential proxy networks, as an example of how poorly secured proxy SDKs can enable internal network access and lateral movement; it warned that if a similar flaw existed in the SDK on the White House network, anyone buying proxy access could use it to reach internal systems.
Remediation
The article does not report any remediation action taken by the White House; Infosecurity Magazine stated it had contacted the White House for comment but had not received a response at publication time.
-
Residential Proxy Software Found Beaconing From White House IT Network (AS2650)
ler a análise desta fonte ocultar
Security researchers at Layer3 Intel and the proxy-tracking service Synthient identified residential proxy software running on devices connected to the dedicated internet address block of the Executive Office of the President (AS2650), effectively allowing third parties to rent and route traffic through White House IP addresses. Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned. Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President, with the activity relatively persistent between October 5 and November 3, exiting from the White House network 236 times during that period. The most notable service identified, Infatica, was founded by Russian national Vladimir Fomenko, whose hosting firm King Servers was previously linked to infrastructure used in the 2016 compromise of Arizona and Illinois election-system databases, though the article does not claim this incident is otherwise related to that activity.
Technical Details
Synthient said the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into "free" mobile and desktop applications. Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Notably, Infatica was not the only proxy service reportedly reselling access to White House internet addresses, as Layer3 Intel found 28 separate residential proxy services were able to exit through this network, and this is public access, anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. Layer3 Intel stated they did not selectively target this network or try to make their probes exit from it, and caught this by chance, simply by requesting global rotating access through these services. The White House did not immediately respond to a request for comment.
Such proxy SDKs are typically bundled into "free" apps that staffers may install on personal or work devices, turning the host's internet connection into a paid exit node without their informed consent. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint's local network for vulnerable systems to infect with malware, and in January 2026 dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in residential proxy services to seize control over devices inside the local networks of unsuspecting users. Brundage told KrebsOnSecurity that some resellers sell bandwidth for as low as 60 cents a gigabyte, meaning for less than a dollar someone can gain access into some of the most confidential and trusted networks, and the reseller ecosystem further enables this with any criminal able to buy access while skipping KYC (Know Your Customer) processes.
Remediation
The article does not describe any acknowledgment or remediation action by the White House, nor does it identify the specific compromised device(s). More broadly, a January 2026 webinar by the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance, and a blog post from security firm Infoblox found that 65% of its customer base was querying one or more residential proxy related domains. Organizations should monitor for and block known residential proxy SDK traffic, restrict installation of unvetted "free" applications on devices with access to sensitive networks, and audit endpoints for proxy software that could expose internal infrastructure to anonymized external access.