White House network (AS2650) devices found serving as residential proxy exit nodes for a month
Security firm Layer3 Intel reported that devices associated with the White House network (autonomous system AS2650, registered to the Executive Office of the President) have been acting as residential proxy exit nodes, a finding made via its newly launched Residential Proxy Observatory. Layer3 Intel found 28 distinct residential proxy services exiting through the network nearly every day between October 5 and November 3, 2026, totaling 236 separate exits, with other residential proxy detection services independently corroborating the data. Most activity occurred in the evening, White House time, between 5 pm and midnight, which Layer3 Intel interprets as a staffer's infected device rather than guest Wi-Fi traffic, likely caused by a compromised proxy SDK. Security firm Synthient said it believes multiple Windows 10 and Windows 11 devices on the network likely have the Infatica proxy SDK installed. The US State Department contacted Layer3 Intel to request a copy of its logs, and the most recently observed activity has since stopped, though the White House itself did not respond to requests for comment.
Detalhes técnicos
Residential proxy networks route third-party traffic through residential IP addresses rather than datacenter infrastructure, which the FBI warned in a March bulletin is commonly abused to conceal command-and-control infrastructure, conduct phishing, send spam, and disguise malicious traffic. Infatica is a commercial SDK that lets app developers monetize users' internet connections by turning devices into proxy exit nodes; Layer3 Intel warned that "poorly secured proxy SDKs can allow internal network access and lateral movement," meaning a flaw in such software on the White House network could let anyone buying proxy access reach internal systems. Layer3 Intel's data retention only goes back to July 10, but given the continuous activity seen and independent corroboration, the firm assesses White House IPs have likely been used by residential proxy networks for some time (layer3intel.com, via theregister.com). Separate reporting identified the proxy exits as originating from six distinct internet addresses within AS2650 and noted that Infatica was founded by Vladimir Fomenko, whose hosting firm King Servers was linked to IP addresses used in 2016 Russian state-backed intrusions into Arizona and Illinois election systems, and that Synthient also traced some activity to a bundled-proxy streaming app called Rave.io (cybernews.com, daily.dev).
Remediação
No vulnerability or fix has been published, as this is an operational security finding rather than a software flaw disclosure; the White House has not issued a public statement, and the State Department is reviewing the logs Layer3 Intel provided. Organizations should audit endpoints for unauthorized proxy SDKs bundled in free consumer applications, monitor for anomalous outbound beaconing on sensitive networks, and treat unexplained residential-proxy-like traffic from staff devices as a potential indicator of compromise.
Linha do tempo
-
White House network (AS2650) devices found serving as residential proxy exit nodes for a month
ler a análise desta fonte ocultar
Security firm Layer3 Intel reported that devices associated with the White House network (autonomous system AS2650, registered to the Executive Office of the President) have been acting as residential proxy exit nodes, a finding made via its newly launched Residential Proxy Observatory. Layer3 Intel found 28 distinct residential proxy services exiting through the network nearly every day between October 5 and November 3, 2026, totaling 236 separate exits, with other residential proxy detection services independently corroborating the data. Most activity occurred in the evening, White House time, between 5 pm and midnight, which Layer3 Intel interprets as a staffer's infected device rather than guest Wi-Fi traffic, likely caused by a compromised proxy SDK. Security firm Synthient said it believes multiple Windows 10 and Windows 11 devices on the network likely have the Infatica proxy SDK installed. The US State Department contacted Layer3 Intel to request a copy of its logs, and the most recently observed activity has since stopped, though the White House itself did not respond to requests for comment.
Technical Details
Residential proxy networks route third-party traffic through residential IP addresses rather than datacenter infrastructure, which the FBI warned in a March bulletin is commonly abused to conceal command-and-control infrastructure, conduct phishing, send spam, and disguise malicious traffic. Infatica is a commercial SDK that lets app developers monetize users' internet connections by turning devices into proxy exit nodes; Layer3 Intel warned that "poorly secured proxy SDKs can allow internal network access and lateral movement," meaning a flaw in such software on the White House network could let anyone buying proxy access reach internal systems. Layer3 Intel's data retention only goes back to July 10, but given the continuous activity seen and independent corroboration, the firm assesses White House IPs have likely been used by residential proxy networks for some time (layer3intel.com, via theregister.com). Separate reporting identified the proxy exits as originating from six distinct internet addresses within AS2650 and noted that Infatica was founded by Vladimir Fomenko, whose hosting firm King Servers was linked to IP addresses used in 2016 Russian state-backed intrusions into Arizona and Illinois election systems, and that Synthient also traced some activity to a bundled-proxy streaming app called Rave.io (cybernews.com, daily.dev).
Remediation
No vulnerability or fix has been published, as this is an operational security finding rather than a software flaw disclosure; the White House has not issued a public statement, and the State Department is reviewing the logs Layer3 Intel provided. Organizations should audit endpoints for unauthorized proxy SDKs bundled in free consumer applications, monitor for anomalous outbound beaconing on sensitive networks, and treat unexplained residential-proxy-like traffic from staff devices as a potential indicator of compromise.