Infrawatch Uncovers Belarusian-Run Residential Proxy Network Inside U.S. Homes

Infrawatch, in collaboration with KrebsOnSecurity, has revealed that a Belarusian national is covertly operating a distributed residential proxy network across U.S. infrastructure, using hardware deployed in at least 20 states and more than 300 active devices. The operation, named DSLRoot, installs dedicated hardware in American residences to provide persistent access to U.S. IP addresses, with DSLRoot reportedly active since at least 2012. Infrawatch attributes the network to Andrei Holas (a.k.a.

Andre Holas, Andrei Golas), who operates under the alias ryzhik777 and has links to Minsk and Moscow, where residential presence has been documented. The DSLRoot proxy software, known as DSLPylon, runs on Windows, creates SOCKS5 and HTTP proxies on ports 3129 and 110 without authentication, and can exploit modem firmware from ARRIS, Motorola, Belkin, D‑Link and ASUS, including a CSRF flaw in ARRIS Surfboard modems.

Access is sold via BlackHatWorld at $190 per month for unlimited proxy use, with a dashboard showing the state, city, and current users of each device. An Ohio-based Air National Guard serviceman hosting equipment in his home was identified as the poster who exposed the network on a public forum, underscoring how trusted individuals can inadvertently enable foreign-controlled infrastructure.