White House network serves as exit point for residential proxy services
Original title: Residential proxy traffic caught leaving the White House network
Layer3 Intel detected proxy traffic exiting White House network 236 times in October, linked to infected devices running Rave.io proxy SDK.
Layer3 Intel's Residential Proxy Observatory observed residential proxy traffic exiting the Executive Office of the President's network (AS2650) 236 times between October 5 and November 3 from six addresses. The exits connect to 28 residential proxy services, suggesting infected devices on the White House network are providing proxy access to botnets. Synthient detected Windows devices running Rave.io, a streaming app bundling multiple proxy SDKs, with traffic peaking in the evening.
Unconfirmed: Specific proxy SDK versions and exact device infections identified by Synthient are based on per-session detection and require further confirmation; no evidence of direct internal network compromise was provided.
- Traffic exited AS2650 236 times from 6 addresses
- 28 separate residential proxy services used
- Pattern indicates evening activity from compromised devices
- Synthient linked to Rave.io app on Windows 10/11
- Proxies observed in remote locations including Antarctica
Impact: unauthorized proxy access from compromised devices to botnets
- Organizations
- Layer3 IntelSynthient
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | rave.io | .” “With high confidence we believe the installed app to be Rave[.]io a shared streaming app that bundles 12 proxy SDKs into th |
From the original article
3 min read at helpnetsecurity.com
The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found. In a blog post, the threat intelligence firm reported that its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.