Researchers Find Residential Proxies on White House Network - SecurityWeek
Security researchers discovered multiple computers on the White House network used as residential proxy exit nodes between October 5 and November 3.
According to Layer3 Intel, six IP addresses on AS2650, the network reserved for the Executive Office of the President, were used by 28 residential proxy services. "Our residential proxy enumeration pipeline exited through the White House network 236 separate times," the security firm reported.
Evening Activity Pattern
Most of the observed activity happens in the evening, between 5 p.m. and midnight, Eastern Time, with almost none in the early morning. "That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK," Layer3 Intel notes.
That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK
Proxy Service Connections
Cybersecurity startup Synthient identified the traffic as coming from Windows 11 machines running the InfaticaSDK. Infatica, based in Singapore, provides access to over 45 million residential IP addresses worldwide. Its founder Vladimir Fomenko also owns King Servers, which hosted six of the eight internet addresses used in the 2016 US election attacks by Russian state-sponsored hackers.
Global Reach
Residential proxy exits have been observed in remote locations worldwide, including Antarctica, the Chagos Islands, the Falklands, Norfolk Island, Pitcairn, South Georgia, Svalbard, and Tokelau. Layer3 Intel recorded 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha, split between Starlink and the island's local provider Sure Saint Helena.
Related
