Residential Proxy Software Found Beaconing From White House IT Network (AS2650)
Security researchers at Layer3 Intel and the proxy-tracking service Synthient identified residential proxy software running on devices connected to the dedicated internet address block of the Executive Office of the President (AS2650), effectively allowing third parties to rent and route traffic through White House IP addresses. Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned. Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President, with the activity relatively persistent between October 5 and November 3, exiting from the White House network 236 times during that period. Layer3 published this research on November 4, 2026, and cross-checked the suspicious addresses against public lookup pages from proxy detection services Spur and Synthient, which independently confirmed them as residential proxy exits (infosecurity-magazine.com). The most notable service identified, Infatica, was founded by Russian national Vladimir Fomenko, whose hosting firm King Servers was previously linked to infrastructure used in the 2016 compromise of Arizona and Illinois election-system databases, though the article does not claim this incident is otherwise related to that activity.
Detalhes técnicos
Synthient said the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into "free" mobile and desktop applications. Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Notably, Infatica was not the only proxy service reportedly reselling access to White House internet addresses, as Layer3 Intel found 28 separate residential proxy services were able to exit through this network, and this is public access, anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. Layer3 Intel stated they did not selectively target this network or try to make their probes exit from it, and caught this by chance, simply by requesting global rotating access through these services. Layer3 founder Sergiy Usatyuk told Infosecurity Magazine the most recent proxy activity was recorded on the evening of November 4, 2026, saying "hopefully, it stops soon" (infosecurity-magazine.com). Layer3 stated it has not confirmed any compromise of White House systems, has backed up the raw logs of the activity, and has shared its findings with a US federal agency (infosecurity-magazine.com). As an example of the risk posed by vulnerable proxy SDKs, Layer3 cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge (ADB) service, through residential proxy networks, warning that a similar flaw in the White House network's SDK could let anyone buying proxy access reach internal systems (infosecurity-magazine.com). The White House did not immediately respond to a request for comment.
Such proxy SDKs are typically bundled into "free" apps that staffers may install on personal or work devices, turning the host's internet connection into a paid exit node without their informed consent. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint's local network for vulnerable systems to infect with malware, and in January 2026 dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in residential proxy services to seize control over devices inside the local networks of unsuspecting users. Brundage told KrebsOnSecurity that some resellers sell bandwidth for as low as 60 cents a gigabyte, meaning for less than a dollar someone can gain access into some of the most confidential and trusted networks, and the reseller ecosystem further enables this with any criminal able to buy access while skipping KYC (Know Your Customer) processes.
Remediação
The articles do not describe any acknowledgment or remediation action by the White House, nor do they identify the specific compromised device(s); Infosecurity Magazine stated it had contacted the White House for comment but had not received a response. More broadly, a January 2026 webinar by the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance, and a blog post from security firm Infoblox found that 65% of its customer base was querying one or more residential proxy related domains. Organizations should monitor for and block known residential proxy SDK traffic, restrict installation of unvetted "free" applications on devices with access to sensitive networks, and audit endpoints for proxy software that could expose internal infrastructure to anonymized external access.
Linha do tempo
-
Residential Proxy Exit Traffic Traced to White House Network (AS2650), No Compromise Confirmed
This follow-up article adds that Layer3 Intel cross-checked the suspicious White House IP addresses against public lookup pages from Spur and Synthient, which independently confirmed them as residential proxy exits. It also reports that Layer3 founder Sergiy Usatyuk told Infosecurity Magazine the most recent proxy activity was recorded on the evening of November 4, 2026, and that Layer3 has backed up the raw logs and shared its findings with a US federal agency while explicitly stating it has not found evidence of a compromise of White House systems. As an illustration of the risk posed by vulnerable proxy SDKs, the article cites Synthient research on the Kimwolf botnet, which reached at least two million devices, mostly Android devices with exposed ADB services, through residential proxy networks.
ler a análise desta fonte ocultar
This follow-up article adds that Layer3 Intel cross-checked the suspicious White House IP addresses against public lookup pages from Spur and Synthient, which independently confirmed them as residential proxy exits. It also reports that Layer3 founder Sergiy Usatyuk told Infosecurity Magazine the most recent proxy activity was recorded on the evening of November 4, 2026, and that Layer3 has backed up the raw logs and shared its findings with a US federal agency while explicitly stating it has not found evidence of a compromise of White House systems. As an illustration of the risk posed by vulnerable proxy SDKs, the article cites Synthient research on the Kimwolf botnet, which reached at least two million devices, mostly Android devices with exposed ADB services, through residential proxy networks.
Layer3 Intel, a residential proxy detection firm, published research on November 4, 2026 showing that residential proxy traffic exited through the White House network 236 times over a 30-day period between October 5 and November 3. The traffic used six IP addresses within AS2650, the autonomous system registered to the Executive Office of the President, and was routed by 28 separate residential proxy services. Layer3 cross-checked the addresses against public lookup pages from proxy detection services Spur and Synthient, which independently confirmed the addresses as residential proxy exits. The firm said it found the activity by chance while requesting ordinary rotating residential proxy access, and emphasized it has not confirmed any compromise of White House systems, though it flagged risk from vulnerable proxy SDKs.
Technical Details
About half of the proxy exit activity occurred between 5pm and midnight Eastern Time, with almost none in the early morning, a pattern Layer3 said suggests a single device used by a person regularly on the network in the evening rather than a public guest Wi-Fi network, possibly infected with a proxy software development kit (SDK). Layer3 founder Sergiy Usatyuk told Infosecurity Magazine that the most recent activity was recorded on the evening of November 4, adding "hopefully, it stops soon". Layer3 said it has backed up the raw logs of the activity and shared its findings with a US federal agency, but has not reported any compromise of White House systems. The firm cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge (ADB) service, through residential proxy networks, as an example of how poorly secured proxy SDKs can enable internal network access and lateral movement; it warned that if a similar flaw existed in the SDK on the White House network, anyone buying proxy access could use it to reach internal systems.
Remediation
The article does not report any remediation action taken by the White House; Infosecurity Magazine stated it had contacted the White House for comment but had not received a response at publication time.
-
Residential Proxy Software Found Beaconing From White House IT Network (AS2650)
ler a análise desta fonte ocultar
Security researchers at Layer3 Intel and the proxy-tracking service Synthient identified residential proxy software running on devices connected to the dedicated internet address block of the Executive Office of the President (AS2650), effectively allowing third parties to rent and route traffic through White House IP addresses. Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned. Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President, with the activity relatively persistent between October 5 and November 3, exiting from the White House network 236 times during that period. The most notable service identified, Infatica, was founded by Russian national Vladimir Fomenko, whose hosting firm King Servers was previously linked to infrastructure used in the 2016 compromise of Arizona and Illinois election-system databases, though the article does not claim this incident is otherwise related to that activity.
Technical Details
Synthient said the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into "free" mobile and desktop applications. Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Notably, Infatica was not the only proxy service reportedly reselling access to White House internet addresses, as Layer3 Intel found 28 separate residential proxy services were able to exit through this network, and this is public access, anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. Layer3 Intel stated they did not selectively target this network or try to make their probes exit from it, and caught this by chance, simply by requesting global rotating access through these services. The White House did not immediately respond to a request for comment.
Such proxy SDKs are typically bundled into "free" apps that staffers may install on personal or work devices, turning the host's internet connection into a paid exit node without their informed consent. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint's local network for vulnerable systems to infect with malware, and in January 2026 dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in residential proxy services to seize control over devices inside the local networks of unsuspecting users. Brundage told KrebsOnSecurity that some resellers sell bandwidth for as low as 60 cents a gigabyte, meaning for less than a dollar someone can gain access into some of the most confidential and trusted networks, and the reseller ecosystem further enables this with any criminal able to buy access while skipping KYC (Know Your Customer) processes.
Remediation
The article does not describe any acknowledgment or remediation action by the White House, nor does it identify the specific compromised device(s). More broadly, a January 2026 webinar by the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance, and a blog post from security firm Infoblox found that 65% of its customer base was querying one or more residential proxy related domains. Organizations should monitor for and block known residential proxy SDK traffic, restrict installation of unvetted "free" applications on devices with access to sensitive networks, and audit endpoints for proxy software that could expose internal infrastructure to anonymized external access.