Why is residential proxy traffic coming from the White House network?
One of the proxy services is a Russian company.
Residential proxy traffic coming from the White House network. By Cybernews / Unsplash.
Follow us
- Layer3 Intel detected 236 residential proxy exits from the White House network between October 5 and November 3.
- Researchers say evening activity suggests an infected staff device, not public guest Wi-Fi.
- The activity involved 28 residential proxy services and traffic from six internet addresses.
- Synthient linked some activity to Infatica and a streaming app that bundles proxy software.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Researchers simply wanted to take a thorough look at residential proxy and anonymized internet activity worldwide when they noticed such activity on AS2650, an internet address network assigned to the Executive Office of the President of the United States. The agency hosts the White House network.
Layer3 Intel, a cybersecurity firm, said the proxy activity was relatively consistent between October 5th and November 3rd and that the proxy nodes exited the White House network 236 times during that period.
According to the researchers, most of the weird activity happens in the evening, with almost none occurring in the early morning.
This, to Layer3 Intel, suggests “a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK (software development kit).”
Researchers find this worrying, essentially suggesting that individuals – members of the White House staff who regularly use the network – could be used as stepping stones for attacks to reach internal systems.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
“Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement. This is how past botnets have spread,” Layer3 Intel said in a blog post.
The Russian connection
A residential proxy is a system that relays communications using IP addresses intended for ordinary homes.
While it can be legitimately used for testing, it can also be used by attackers seeking to conceal their communications. Threat actors can and do exploit residential proxy networks to hide their real locations, bypass rate limits, launch brute-force attacks, or perform account takeovers.
According to Layer3 Intel, as many as 28 different residential proxy services were detected on AS2650. The communication originated from six different IP addresses.
The proxy-tracking company Synthient said the activity it saw beaconing out of AS2650 was related to multiple Windows 11 installations of a service called Infatica. That's a proxy program often integrated into free mobile and desktop applications.
Infatica’s founder, Vladimir Fomenko, is a Russian citizen whose hosting firm, King Servers, was home to six of the eight web addresses used by the Kremlin to compromise databases for election systems in Arizona and Illinois in 2016.
Sentient also said it believes the residential proxy activity at the White House could be traced to an app called Rave[.]io, a shared streaming app that bundles 12 proxy SDKs into the platform.
