Ben

scaling @synthient

[Ben @deobfuscately]

@MarginLegend @synthient Publicly this is what Plainproxies is saying but they are still continuing to resell bandwidth.

[Ben @deobfuscately]

In August IPRoyal announced the termination of their reseller program, our findings show the opposite. Since the alleged termination @Synthient continues to see an overwhelming number of proxy providers reselling bandwidth from IPRoyal.

[Ben @deobfuscately]

IPRoyal planning to terminate their reseller program starting September 14th. This likely comes following the NetNut disruption. Will be interesting to see if this includes their own reseller brands such as Marsproxies.

[Ben @deobfuscately]

@Gi7w0rm 🪦all the frauders will miss it🪽

[Ben @deobfuscately]

@ilbaroni_

[Ben @deobfuscately]

IPCola[.]com has exit scammed after the takedown of their bandwidth monetization platform Gaganode 🦆

[Synthient @synthient]

Residential proxies, ad fraud, and credential theft have flourished through sophisticated pre-infected device schemes. This research, in partnership with the @motionpictures and in collaboration with @Google, @trendaisecurity , @BlackLotusLabs , and @SecureWithHUMAN, disrupts one of these operators.

Synthient’s Research Team documents its findings in this report, showing how the operators distributed over 1.3 million devices to unsuspecting consumers and how this supply chain pushed numerous backdoors from APSolo to Honeygain.

Read more here: https://t.co/qOR4fx9xzr

[Ben @deobfuscately]

@ilbaroni_ 😢they scammed on the bandwidth anyways

[Ben @deobfuscately]

@TuringAlex @Xlab_qax 🤔crypto miner?

[Ben @deobfuscately]

Pivoting on the proxy providers observed here and the device, we narrowed it down to a single likely app. With high confidence we believe this to be the app providing network access into the Whitehouse.

[Synthient @synthient]

🧵 1/N
With high confidence we believe the installed app to be Rave[.]io a shared streaming app that bundles 12 proxy SDKs into the platform.

[Ben @deobfuscately]

@IntCyberDigest We are able to see this is a Windows 11 device so highly unlikely to be a guest device.
https://t.co/5ABf0JgHyf

[Synthient @synthient]

Several Whitehouse staffers are running a Windows 11 machine with InfaticaSDK installed 👀

[Synthient @synthient]

Several Whitehouse staffers are running a Windows 11 machine with InfaticaSDK installed 👀

[Ben @deobfuscately]

@TuringAlex 😆🍻many more botnets to come 🫂

[Ben @deobfuscately]

@snitching4fun @synthient @motionpictures @Google @trendaisecurity @BlackLotusLabs @SecureWithHUMAN This was edited after our research and was not labeled a scam afaik

[Ben @deobfuscately]

@PiipperiV2 @vxdb @synthient This was edited after our research and was not labeled a scam afaik

[Ben @deobfuscately]

@pulgagr @vxdb @synthient If you go to settings on your device you can enable developer mode -> connect to it over port 5555 -> run adb shell pm list packages -> if you see a com.oemservice download that and check if it’s flagged as malicious on virustotal. If it is, id get rid of it.

[Ben @deobfuscately]

@thezedwards Ty 🙂‍↕️this one took way too long to research

[Ben @deobfuscately]

This has been several months of research, digging through complex backdoors and exploring an otherwise undocumented space. Happy to see the research finally public 😄 Congrats to all of the teams involved 🎉

[Synthient @synthient]

Residential proxies, ad fraud, and credential theft have flourished through sophisticated pre-infected device schemes. This research, in partnership with the @motionpictures and in collaboration with @Google, @trendaisecurity , @BlackLotusLabs , and @SecureWithHUMAN, disrupts one of these operators.

Synthient’s Research Team documents its findings in this report, showing how the operators distributed over 1.3 million devices to unsuspecting consumers and how this supply chain pushed numerous backdoors from APSolo to Honeygain.

Read more here: https://t.co/qOR4fx9xzr

[Ben @deobfuscately]

Indicators of compromise and observables as always can be found below:

https://t.co/NytHYlxQOz

[Ben @deobfuscately]

@zeyu1337 Crazzzzy

[Ben @deobfuscately]

@0x4D31 Interesting the ip address is MULLVAD vpn

[Ben @deobfuscately]

This comes with a series of maintained SDKs to help make integration easier.

[Ben @deobfuscately]

Synthient has received one of its largest updates in a while. Beyond expanding the platform, we are bringing accurate in house geolocation to our customers for free.

There are a lot of exciting things planned for this and next year.