Residential Proxy Services Found Exiting Traffic from White House Network (AS2650)
Security researchers at Layer3 Intel and Synthient identified residential proxy exit nodes operating from the Executive Office of the President's dedicated internet address range (AS2650) between October 5 and November 3, 2026. The traffic was linked to Infatica, a proxy SDK often bundled into free mobile and desktop apps, founded by Vladimir Fomenko, whose earlier hosting firm King Servers was linked to the 2016 Russian intrusions into Arizona and Illinois election systems. Layer3 Intel found that 28 separate residential proxy services could exit traffic through the White House network, with activity recorded on 26 of 30 days, mostly in the evening, and 236 proxy exits observed overall. The White House did not respond to requests for comment, and researchers stress this is publicly accessible proxy infrastructure, not a targeted compromise.
Detalhes técnicos
Layer3 Intel detected proxy nodes beaconing from six internet addresses within AS2650. Synthient attributed the traffic to multiple Windows 11 installations running the Infatica proxy client, which is typically monetized via SDKs embedded in third-party apps that staffers may have installed on personal or government devices. Researchers note that residential proxy ecosystems have previously been shown (late 2025 and January 2026) to contain vulnerabilities allowing attackers to pivot into the proxy user's local network, and that proxy bandwidth can be purchased for as little as $0.60/GB with no KYC checks, lowering the bar for abuse. Similar residential proxy presence has reportedly been found across hundreds of other government, utility, healthcare and financial networks.
Remediação
The article does not describe specific remediation steps taken by the White House; researchers generally recommend auditing devices for unauthorized proxy/VPN SDKs, restricting installation of unvetted free apps on networks with sensitive access, and monitoring for residential-proxy-related domains and traffic patterns.
Linha do tempo
-
Residential Proxy Services Found Exiting Traffic from White House Network (AS2650)
ler a análise desta fonte ocultar
Security researchers at Layer3 Intel and Synthient identified residential proxy exit nodes operating from the Executive Office of the President's dedicated internet address range (AS2650) between October 5 and November 3, 2026. The traffic was linked to Infatica, a proxy SDK often bundled into free mobile and desktop apps, founded by Vladimir Fomenko, whose earlier hosting firm King Servers was linked to the 2016 Russian intrusions into Arizona and Illinois election systems. Layer3 Intel found that 28 separate residential proxy services could exit traffic through the White House network, with activity recorded on 26 of 30 days, mostly in the evening, and 236 proxy exits observed overall. The White House did not respond to requests for comment, and researchers stress this is publicly accessible proxy infrastructure, not a targeted compromise.
Technical Details
Layer3 Intel detected proxy nodes beaconing from six internet addresses within AS2650. Synthient attributed the traffic to multiple Windows 11 installations running the Infatica proxy client, which is typically monetized via SDKs embedded in third-party apps that staffers may have installed on personal or government devices. Researchers note that residential proxy ecosystems have previously been shown (late 2025 and January 2026) to contain vulnerabilities allowing attackers to pivot into the proxy user's local network, and that proxy bandwidth can be purchased for as little as $0.60/GB with no KYC checks, lowering the bar for abuse. Similar residential proxy presence has reportedly been found across hundreds of other government, utility, healthcare and financial networks.
Remediation
The article does not describe specific remediation steps taken by the White House; researchers generally recommend auditing devices for unauthorized proxy/VPN SDKs, restricting installation of unvetted free apps on networks with sensitive access, and monitoring for residential-proxy-related domains and traffic patterns.