Residential proxy software (Infatica, Rave.io SDKs and 27 other services) found exiting through White House network AS2650
Layer3 Intel and Synthient reported that residential proxy nodes were beaconing from the Executive Office of the President network (AS2650). The activity was relatively persistent from October 5 to November 3, 2026. Layer3 counted 236 exits from the White House network over that period, published in research on November 4. Synthient tied the activity to multiple Windows 10 and 11 installations of Infatica, a proxy program often bundled into "free" apps (theregister.com). On November 5 Synthient said devices were beaconing to Geonode, Infatica and Mellowtel. It assessed with high confidence that the installed app is Rave.io, a shared streaming app that bundles 12 proxy SDKs (helpnetsecurity.com). Infatica's founder, Vladimir Fomenko, ran the hosting firm King Servers. In 2016 that firm hosted six of the eight IP addresses Russian state security services used against election systems in Arizona and Illinois. Layer3 reported no compromise of White House systems. Its founder Sergiy Usatyuk said activity was still seen on the evening of November 4, hours after the blog went live, and has since stopped (infosecurity-magazine.com, theregister.com). The US State Department asked Layer3 for its logs on November 5 and received them (theregister.com). The White House had not responded to requests for comment. This report relies on KrebsOnSecurity, Infosecurity Magazine, The Register and Help Net Security. No vendor advisory or other primary source was checked.
Detalhes técnicos
- Layer3 Intel saw the exits come from six IP addresses on 26 of 30 days, mostly between 5 p.m. and midnight. It logged 28 distinct services exiting nearly daily (theregister.com).
- Layer3 found 28 separate residential proxy services able to exit through the network. It said anyone can buy this access for a few dollars and that it found the exits by chance while requesting rotating access. It spotted them in its new Residential Proxy Observatory (infosecurity-magazine.com).
- Layer3's data retention goes back to July 10. Usatyuk said continuous activity over months suggests the White House IPs may have been used by residential proxy networks for some time (theregister.com).
- Spur and Synthient public lookup pages independently flagged the addresses as residential proxy exits (infosecurity-magazine.com). Other detection services logged the same activity (theregister.com).
- Layer3 says the evening pattern suggests one person's device infected with a proxy SDK, not a guest Wi-Fi network. It stresses that its data shows the exits, not the device or person, and cannot say how many machines are involved (infosecurity-magazine.com, theregister.com).
- Synthient first claimed on November 4 that several staffers ran Windows 11 with InfaticaSDK. On November 5 it said it detects devices per session and found Windows 10 and 11 devices beaconing to Geonode, Infatica and Mellowtel. Rave runs on Mac, iPhone, Android and Windows (helpnetsecurity.com).
- Researcher Matt Johansen commented on X that devices on the network are compromised or at least provide residential proxy access to botnets (helpnetsecurity.com).
- The likely cause is proxy SDKs embedded in apps that staff installed on work or personal devices. Developers earn a small payment per installation.
- Risk: proxy exits let others route traffic through trusted government address space, and the proxy software exposes local networks. Synthient founder Ben Brundage said reseller access skips KYC checks. Layer3 warned that if an SDK on the network had a flaw like those seen before, buyers of proxy access could reach internal systems. It cited the Kimwolf botnet, which reached at least two million devices, mostly Android with exposed ADB (infosecurity-magazine.com, helpnetsecurity.com).
- The Observatory also recorded 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha. It recorded three observations in Antarctica, from a Cloudflare WARP address tied to McMurdo Station (helpnetsecurity.com).
- The FBI warned in a March 2026 bulletin that residential proxies are used to hide C2, phish and spam, and that devices are turned into nodes via malware, illicit SDK partnerships and VPNs with hidden terms (theregister.com).
- Background cited in the article: a vulnerability in these services was mass exploited in late 2025 to probe local networks behind proxy endpoints. Dozens of services patched in January 2026 after Synthient showed it could be abused to take over devices on those networks.
- Spur (January 2026) found residential proxies in nearly 300 government networks, 318 utilities, 166 healthcare organizations and 141 banking and finance firms. Infoblox found 65% of its customers querying proxy-related domains.
Remediação
Layer3 backed up the raw logs and shared its findings with a US federal agency (infosecurity-magazine.com). That agency is the State Department, which requested the logs on November 5 (theregister.com). The articles give no other remediation steps. Defenders should inventory and block residential proxy SDKs and domains on managed endpoints. They should also restrict installation of free apps, such as Rave.io, on devices that connect to sensitive networks.
Relatos divergentes
- Earlier reporting (KrebsOnSecurity, via the known report) said Windows 11 installations of Infatica. The Register, citing Synthient, says Windows 10 and 11 devices. Help Net Security reports Synthient's later statement that the installed app is Rave.io with 12 bundled proxy SDKs, not only Infatica.
Linha do tempo
-
Residential proxy traffic exits via White House network AS2650; Synthient links it to the Rave.io app with bundled proxy SDKs
Adds Synthient's high-confidence attribution of the activity to the Rave.io streaming app, which bundles 12 proxy SDKs. It also adds the Geonode and Mellowtel beaconing, the November 4 and 5 Synthient statements, researcher Matt Johansen's comment, and Layer3's findings in Saint Helena and Antarctica.
ler a análise desta fonte ocultar
Adds Synthient's high-confidence attribution of the activity to the Rave.io streaming app, which bundles 12 proxy SDKs. It also adds the Geonode and Mellowtel beaconing, the November 4 and 5 Synthient statements, researcher Matt Johansen's comment, and Layer3's findings in Saint Helena and Antarctica.
Layer3 Intel reported that its proxy enumeration pipeline exited through AS2650, the network of the Executive Office of the President, 236 times between October 5 and November 3, 2026. The exits came from six addresses on 26 of 30 days, and 28 residential proxy services offered the route. Synthient said it detected Windows 10 and 11 devices beaconing to Geonode, Infatica and Mellowtel. It assessed with high confidence that the installed app is Rave.io, a shared streaming app that bundles 12 proxy SDKs. Layer3's data shows only the exits, not the device or the person. It reported no confirmed compromise of White House systems.
Technical Details
- About half of the traffic falls between 5 p.m. and midnight Eastern time, and almost none in the early morning. Layer3 reads this as one regular user's device infected with a proxy SDK.
- Layer3 did not target the network. It saw the exits while requesting global rotating access in its Residential Proxy Observatory, and other detection services independently flag the addresses as proxy exits.
- Synthient first claimed on November 4 that staffers were running Windows 11 with InfaticaSDK. On November 5 it said it detects devices per session.
- Layer3 cited the Kimwolf botnet, documented by Synthient, which reached at least 2 million devices, mostly Android with exposed ADB, through residential proxy networks. It warned that a flaw in an SDK on this network could let proxy buyers reach internal systems.
- The Observatory also recorded 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha. It recorded three observations in Antarctica, from a Cloudflare WARP address tied to McMurdo Station.
Remediation
The article gives no remediation steps. Sensible measures are to block residential proxy SDKs and domains on managed endpoints and to restrict free apps such as Rave on devices that connect to sensitive networks.
-
Residential proxy exits (likely Infatica SDK) found on White House network; State Department requests Layer3 logs
The Register adds that Layer3's retention reaches back to July 10, so the activity may be months old. Synthient now cites multiple Windows 10 and 11 devices. Residential proxy activity stopped after the Layer3 blog went live on Wednesday night. The State Department requested Layer3's logs on Thursday, and Layer3 sent them. The article also cites the FBI's March 2026 bulletin on residential proxies.
ler a análise desta fonte ocultar
The Register adds that Layer3's retention reaches back to July 10, so the activity may be months old. Synthient now cites multiple Windows 10 and 11 devices. Residential proxy activity stopped after the Layer3 blog went live on Wednesday night. The State Department requested Layer3's logs on Thursday, and Layer3 sent them. The article also cites the FBI's March 2026 bulletin on residential proxies.
Layer3 Intel reported that devices on the White House network appear to act as residential proxy exit nodes. It found the activity through its new Residential Proxy Observatory. Layer3 logged 28 distinct residential proxy services exiting into the network almost daily between October 5 and November 3, 2026, with 236 separate exits. Other residential proxy detection services logged the same activity. Synthient believes several Windows 10 and 11 machines run the Infatica SDK. The evening timing (5 pm to midnight) points to a staff device rather than a guest. The article does not say how the SDK got there, and the White House did not respond to questions.
Technical Details
- Layer3's data retention goes back to July 10, and its founder Sergiy Usatyuk said continuous activity over months suggests the White House IPs have been used by residential proxy networks for some time (theregister.com).
- Layer3 notes that poorly secured proxy SDKs have allowed internal network access and lateral movement in past research. It warns that buyers of proxy access could reach internal systems if an SDK on this network has the same flaw (theregister.com).
- Layer3's data does not show how many machines are acting as exit nodes (theregister.com).
- The FBI warned in March 2026 that residential proxies are used to hide C2 traffic, run phishing and send spam. It named malware, illicit SDK partnerships and VPNs with hidden terms as ways devices are turned into nodes (theregister.com).
Remediation
The article lists no formal remediation steps. Usatyuk said the last activity was seen Wednesday night, hours after Layer3's blog went live, and has since stopped. The US State Department asked Layer3 for its logs on Thursday morning, and Usatyuk said he sent them (theregister.com).
-
Residential proxy traffic exits via White House network AS2650 in 236 observations, Layer3 Intel reports
Layer3 Intel's own research (Infosecurity Magazine, Nov 5) adds a first-hand account: it found the exits by chance, Spur and Synthient independently confirmed them, and the evening pattern suggests a single infected device. Layer3 reports no compromise of White House systems. Activity was still seen on November 4. Layer3 backed up the raw logs and shared its findings with a US federal agency. It also cites the Kimwolf botnet (at least two million devices) as an example of how proxy SDKs spread. This article does not name Infatica.
ler a análise desta fonte ocultar
Layer3 Intel's own research (Infosecurity Magazine, Nov 5) adds a first-hand account: it found the exits by chance, Spur and Synthient independently confirmed them, and the evening pattern suggests a single infected device. Layer3 reports no compromise of White House systems. Activity was still seen on November 4. Layer3 backed up the raw logs and shared its findings with a US federal agency. It also cites the Kimwolf botnet (at least two million devices) as an example of how proxy SDKs spread. This article does not name Infatica.
Layer3 Intel, a New York-based residential proxy detection firm, reported on November 4 that residential proxy traffic exited through the Executive Office of the President network (AS2650) 236 times between October 5 and November 3, 2026. 28 residential proxy services could route traffic through six addresses, and exits were recorded on 26 of the 30 days. Layer3 cross-checked the addresses against public lookups from Spur and Synthient, which independently flagged them as residential proxy exits. About half of the activity fell between 5pm and midnight Eastern Time, which Layer3 says points to one person's device infected with a proxy SDK, not a guest Wi-Fi network. Layer3 reported no compromise of White House systems, and the White House had not commented at publication.
Technical Details
- Layer3 found the exits by chance while requesting ordinary global rotating access through public proxy services. It said anyone can get the same exits for a few dollars. It saw them in its newly launched Residential Proxy Observatory (Layer3 Intel via infosecurity-magazine.com).
- Layer3 stresses that its data shows the exits, not the device or person behind them.
- Layer3 founder Sergiy Usatyuk said the most recent activity was recorded on the evening of November 4.
- Risk: a poorly secured proxy SDK can let buyers of proxy access reach internal networks and move laterally. Layer3 cited Synthient research on the Kimwolf botnet, which reached at least two million devices, mostly Android devices with an exposed ADB service, through residential proxy networks.
Remediation
The article gives no remediation steps. Layer3 said it backed up the raw logs and shared its findings with a US federal agency. Defenders should inventory and block residential proxy SDKs and their domains on managed endpoints.
-
Residential proxy software (Infatica and 27 other services) found exiting through White House Executive Office network AS2650
ler a análise desta fonte ocultar
Layer3 Intel and Synthient reported that residential proxy nodes were beaconing from the Executive Office of the President network (AS2650). The activity was relatively persistent from October 5 to November 3, 2026. Layer3 counted 236 exits from the White House network over that period. Synthient tied the activity to multiple Windows 11 installations of Infatica, a proxy program often bundled into "free" apps. Infatica's founder, Vladimir Fomenko, ran the hosting firm King Servers. In 2016 that firm hosted six of the eight IP addresses Russian state security services used against election systems in Arizona and Illinois. The White House had not responded to a request for comment. This summary relies on the single KrebsOnSecurity article. No vendor advisory or other primary source was checked.
Technical Details
- Layer3 Intel saw the exits come from six IP addresses on 26 of 30 days, mostly between 5 p.m. and midnight.
- Layer3 found 28 separate residential proxy services able to exit through the network. It said anyone can buy this access for a few dollars and that it found the exits by chance.
- The likely cause is proxy SDKs embedded in apps that staff installed on work or personal devices. Developers earn a small payment per installation.
- Risk: proxy exits let others route traffic through trusted government address space, and the proxy software exposes local networks. Synthient founder Ben Brundage said reseller access skips KYC checks.
- Background cited in the article: a vulnerability in these services was mass exploited in late 2025 to probe local networks behind proxy endpoints. Dozens of services patched in January 2026 after Synthient showed it could be abused to take over devices on those networks.
- Spur (January 2026) found residential proxies in nearly 300 government networks, 318 utilities, 166 healthcare organizations and 141 banking and finance firms. Infoblox found 65% of its customers querying proxy-related domains.
Remediation
The article gives no remediation steps. Defenders should inventory and block residential proxy SDKs and domains on managed endpoints. They should also restrict installation of free apps on devices that connect to sensitive networks.