1. Basic Information

2. Executive Summary

Six IP addresses assigned to AS2650 and allocated to the Executive Office of the President were used as residential proxy exit nodes a total of 236 times across 28 public residential proxy services on 26 of the 30 days. While the proxy functionality was confirmed, the specific devices, users, and installation paths remain unidentified.

3. Attack Flow

  1. A residential proxy provider offers a device or connection within AS2650 as an exit node.
  2. Layer3 Intel global rotating access requests exited from the six AS2650 IPs 236 times.
  3. General proxy purchasers were also able to send requests that appeared to originate from the organization network via the same service.

4. Attacker Position and Prerequisites

  • Purchasers of public residential proxy services can use the exit nodes assigned by the provider.
  • Management rights or internal access to devices within AS2650 have not been confirmed.

5. Visibility for Victims and Administrators

Victim Perspective

  • There may be no noticeable UI changes even if device resources and network lines are used to relay third-party traffic.

Administrator Perspective

  • Indicators include consumer proxy SDKs, unapproved applications, persistent connections to providers, and nighttime outbound traffic.

6. Success and Failure Conditions

Success Conditions

  • A device or connection within AS2650 is registered with a provider and capable of relaying external client traffic.

Failure Conditions and Countermeasures

  • Stop relaying using application control for unapproved proxy and bandwidth-sharing SDKs, along with egress filtering.
  • Network segmentation for guest, BYOD, and managed endpoints limits the internal reachable scope, but segmentation alone does not guarantee stopping the relay.

7. What Happens Upon Success

  • Third parties can leverage the organization IP reputation and geographical trust to make scans, fraud, and credential attacks appear to originate from the organization. Internal access has not been confirmed.

8. Observable Logs

  • Email: No email-based evidence has been published.
  • Proxy/SWG/DNS: Check for long-duration communications to proxy provider and SDK domains.
  • Endpoint/EDR: Verify proxy SDKs, bundled applications, services, and listeners.
  • Identity/IdP: Cross-reference user logins and activity times, but do not determine identity based on timestamps alone.
  • SaaS/Cloud: Verify MDM inventory and unapproved applications.
  • Network: DNS checks for name resolution, flows check for destinations, times, and volume, and NAT checks for translation mappings, which should be evaluated in correlation with EDR process information and other sources. DNS alone cannot confirm connection duration or relay execution. These are investigative suggestions for your own organization rather than logs published in this case.

9. Determining Attack Success

Confirmed by Public Information

  • Public Information: Layer3 Intel confirmed that its enumeration traffic was relayed 236 times. Spur and Synthient also identified the IPs as proxy exit nodes. Attack attempts, infection, and internal access by malicious third parties remain unconfirmed.
  • Scope: Observations made between October 5 and November 3, 2026, regarding six IPs in AS2650.

Criteria for Internal Assessment

  • Do not assume infection based on IP reputation alone; gather evidence of provider sessions, endpoint processes and SDKs, and relayed traffic.

10. Investigation Playbook

  • Trigger: Start with residential proxy detection for organization IPs, provider communications, and unapproved SDKs.
  • Initial Verification: Correlate IPs, NAT, assets, timestamps, ownership, and network segments.
  • Endpoint: Preserve software inventory, processes, services, installers, and persistence mechanisms.
  • Authentication and Cloud: Check user logins and MDM, avoiding individual attribution on shared lines.
  • Subsequent Actions: Investigate relay destinations, internal address access, and credential misuse.
  • Containment: Stop and remove SDKs, isolate devices, and correct segment and egress policies.
  • Classification Categories: Separate IP listing, active exit, SDK, unauthorized installation, and internal access.

11. Defense and Detection Ideas

  • Single Event: Detect unapproved proxy and bandwidth-sharing processes and services.
  • Timeline Correlation: Correlate SDK installation, provider sessions, relay activity, and external exit determination.
  • Threat Hunting: Verify organization ASNs and public IPs using proxy intelligence and trace them back to NAT sessions.
  • Log Gaps: Short retention periods for NAT and guest logs prevent tracing from IPs back to devices.
  • Priority Controls: Prioritize managed app policies, egress controls, segmentation, and NAT and flow log retention.

12. Facts, Inference, and Hypothesis

Facts

  • Layer3 Intel used six IPs in AS2650 as residential proxy exit nodes across 26 out of 30 days, involving 28 providers and 236 observations.
  • Public contexts from Spur and Synthient also identified the relevant IPs as proxy exit nodes.
  • Approximately half of the activity occurred between 17:00 and 24:00 Eastern Time, with almost none during early morning hours.

Inference

  • Based on the timing pattern, Layer3 Intel suggested that a device belonging to someone using the network at night may contain a proxy SDK, but the specific device and person remain unidentified.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

There are no MITRE ATT&CK techniques corresponding to this case because the attacker usage purposes and communication pathways have not been confirmed.

14. Unknowns and Additional Investigation

  • The number of devices, owners, SDK installation paths, malicious versus consented nature, relayed traffic, and internal access have not been published. Regarding the operating system, SecurityWeek reported that Synthient identified Windows 11 and the Infatica SDK, but the basis for that identification remains unconfirmed.

15. Impact on SOCs and Organizations

Residential proxies also appear on corporate ASNs. An investigation design is required that combines external reputation monitoring with endpoint inventory, NAT and flow logs, and BYOD segmentation, without determining users or infections based on IPs alone.

16. Target Audience Summary

  • For SOCs: Trace proxy detections for organization IPs back to NAT and flow logs and endpoint processes.
  • For Administrators: Restrict proxy and bandwidth-sharing SDKs using managed app policies and egress controls.
  • For Users: Verify bandwidth-sharing and proxy features bundled with free applications.