White House Network Used by Residential Proxy Services
Security experts have issued a warning that numerous computers and mobile devices within the White House network are operating as residential proxy nodes. This alarming discovery means that internet addresses reserved for the Executive Office of the President (AS2650) are available for rent to third parties, potentially exposing a highly sensitive network to cybercriminal activities and complicating attribution efforts for malicious traffic. This ongoing activity, detected over several weeks, represents a significant operational security lapse, allowing anonymous access to one of the world’s most critical networks, as reported by KrebsOnSecurity.
Technical Details and Observed Activity
Layer3 Intel, a cybersecurity firm, detected multiple residential proxy nodes beaconing out from the AS2650 network. Their observations indicated persistent proxy activity between October 5 and November 3, with 236 recorded proxy exits from the White House network during this period. The activity originated from six distinct internet addresses, occurring on 26 out of 30 days, primarily during evening hours.
Further analysis by the proxy tracking company Synthient identified that much of this activity was linked to multiple Windows 11 installations of a service called Infatica. Infatica is a residential proxy program often bundled with seemingly free mobile and desktop applications. Of particular concern is Infatica’s founder, Vladimir Fomenko, a Russian national whose previous hosting firm, King Servers, was implicated in hosting internet addresses used by Russian state security services to compromise election systems in Arizona and Illinois in 2016.
Alarmingly, Infatica was not the sole culprit. Layer3 Intel identified a total of 28 separate residential proxy services capable of exiting through the White House network. This suggests a widespread issue rather than an isolated incident involving a single rogue application. The ease of access is stark: “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it,” Layer3 Intel noted, underscoring the public accessibility to these critical network points.
The Broader Implications of Residential Proxies
Residential proxy services enable users to route their internet traffic through another individual’s device, effectively masking their true IP address and location. While legitimate uses exist, these services are heavily abused by cybercriminals for activities such as account takeover, advertising fraud, mass content scraping for AI projects, and other illicit operations. The ability for malicious actors to rent access through a White House IP address provides a significant layer of anonymity and perceived legitimacy to their activities, making it challenging to detect residential proxy activity on corporate networks and attribute attacks.
Beyond anonymity, residential proxy services themselves have proven to be significant security risks. In late 2025 and January 2026, vulnerabilities were discovered and exploited in these services. Cybercriminals leveraged these flaws to probe and gain control over devices within the local networks of unsuspecting users, illustrating how the mere presence of such software can create direct attack vectors into an organization’s internal infrastructure. This underscores the critical need for organizations, especially those handling sensitive information, to mitigate risks of employee device proxy services.
The problem is not confined to the White House. Research indicates widespread prevalence of residential proxies across various critical sectors. A January 2026 webinar by Spur revealed residential proxies in nearly 300 government networks, 318 utility companies, 166 healthcare providers, and 141 banking and finance institutions. Infoblox further noted that 65% of its customer base queried residential proxy-related domains, highlighting the pervasive nature of this threat across enterprise environments.
Actionable Recommendations and Mitigation
Organizations, particularly those in sensitive sectors, must prioritize identifying and eliminating unauthorized residential proxy services to prevent public access to trusted networks and understand the impact of Infatica proxy services on government networks. Here are key recommendations:
- Comprehensive Device Auditing: Implement regular audits of all network-connected devices, including employee-owned mobile devices used for work, to identify unauthorized software installations. Utilize Endpoint Detection and Response (EDR) solutions to monitor for suspicious outbound network connections characteristic of proxy services.
- Network Segmentation and Egress Filtering: Segment networks to limit the blast radius of any compromised endpoint. Implement strict egress filtering to block outbound connections to known residential proxy infrastructure and unusual ports or protocols.
- Application Whitelisting: Deploy application whitelisting policies to prevent the installation and execution of unauthorized software, especially ‘free’ applications that may bundle proxy SDKs. This is a critical step to prevent the introduction of such services.
- Enhanced DNS Monitoring: Monitor DNS queries for known residential proxy domains. Security firms like Infoblox have highlighted the effectiveness of this approach in detecting proxy activity.
- User Education and Policy Enforcement: Educate employees about the risks associated with installing third-party applications, especially ‘free’ software, on work devices or devices connected to corporate networks. Enforce clear policies against the use of unauthorized software and personal proxy services.
- Regular Security Awareness Training: Train staff on identifying phishing attempts and social engineering tactics that might lead to the installation of malicious or unwanted software like residential proxies. Stress the importance of reporting suspicious activity.
The presence of residential proxies on such a high-profile network necessitates immediate and decisive action. Organizations must treat any unauthorized proxy activity as a critical incident, given the potential for data exfiltration, network compromise, and severe reputational damage.
Related: Mexico’s Cybersecurity Plan 2025-2030: Addressing Rising Threats, Syrian Electronic Army Hacker Sentenced for Disinformation Campaigns