Cybersecurity researchers at Layer3 Intel and Synthient identified residential proxy activity originating from the White House network, according to findings reported by Krebs on Security and The Register. The researchers detected 28 different residential proxy services routing traffic through the White House network during a period spanning from October 5th to November 3rd, with most activity occurring between 5PM ET and midnight.
Residential proxies function by allowing users to rent access to home IP addresses and route their internet traffic through those connections, effectively masking the true origin of their online activity. While legitimate uses exist for such services—including ad verification and quality assurance testing—malicious actors have exploited them for activities ranging from botnet creation to account takeovers and bypassing geolocation restrictions. The security firm Spur noted that the technology presents significant defensive challenges for organizations attempting to protect their networks.
Layer3 Intel suggested the proxy activity likely originated from a single individual rather than a public network, based on the consistent timing pattern of usage. Synthient identified the watch party application Rave as a potential source, noting that the platform incorporates 12 different proxy software development kits. The firm also documented Windows 10 and Windows 11 devices on the White House network communicating with known proxy providers including Geonode, Infatica, and Mellowtel.
Notably, Infatica is operated by Vladimir Fomenko, who also owns King Servers—a company previously linked to cyberattacks targeting election systems in Illinois and Arizona in 2016. Layer3 emphasized that the identified residential proxy access remains available to the general public, requiring only a simple registration process and payment of approximately a few dollars to obtain access through standard proxy service platforms.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI