Overview
- Independent firm Layer3 Intel recorded 236 residential‑proxy exits through six IP addresses in AS2650, the Executive Office of the President network, during the October 5 to November 3 monitoring period.
- Layer3 found those six addresses were available through 28 separate commercial residential‑proxy services, meaning paying customers could route traffic that appears to originate from the presidential network.
- Traffic timestamps showed about half of the activity between 5 p.m. and midnight Eastern Time, a pattern Layer3 said suggests a regularly used device on the network rather than transient guest Wi‑Fi.
- Proxy tracker Synthient first linked sessions to InfaticaSDK on Windows systems and later said it has high confidence the app Rave.io, which bundles multiple proxy SDKs, is present on implicated devices.
- Layer3 has preserved raw logs and shared findings with a U.S. federal agency, and researchers stressed there is no public evidence of a system compromise but warned that poorly secured proxy SDKs can let outsiders probe or reach internal systems and have been abused in past botnet campaigns.