IC Technology & Cyber — 2026-11-09

Researchers Discover White House Network Serving as Exit Point for Residential Proxy Services, Raising Counterintelligence Concerns

BLUFUncontrolled proxy SDKs on Executive Office of the President endpoints hand any commercial buyer the ability to route traffic through White House network space, creating a counterintelligence exposure that demands immediate endpoint audit.

Layer3 Intel reported that its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3 12. Krebs on Security reported that the exits originated from six addresses on 26 of 30 days, primarily between 5 p.m. and midnight, and that 28 residential proxy services offered exit through the network 2. Synthient attributed the activity to Windows 11 installations of Infatica's proxy SDK, according to Krebs and BankInfoSecurity 23; Krebs noted that Infatica's founder, Vladimir Fomenko, previously operated King Servers, which hosted six of eight addresses Russian state security services used against Arizona and Illinois election systems in 2016 2. The White House did not respond to requests for comment 23.

Analysis
Residential proxy SDKs on White House staff's Windows 11 machines turn the Executive Office of the President network into rentable exit infrastructure, so any buyer of proxy access can mask traffic as presidential-office origin. The evening-hours pattern points to staff devices rather than guest Wi-Fi, making this a bring-your-own-device and endpoint-control failure, not a perimeter breach. Infatica's Russian ownership raises a counterintelligence question, but nothing reported shows Moscow directed the installations or reached internal systems. Commercial app monetization on personal devices may instead explain the activity, with no state targeting. Confidence is low: one original report, relayed by three outlets, with no White House confirmation and no independent technical data on the devices. Defenders should audit EOP endpoints for proxy SDKs and block known proxy-service domains at the network edge.

4 sources

Residential proxy traffic caught leaving the White House network - Help Net Security
Want to Rent an Internet Address at the White House? - Krebs on Security
White House IP Addresses Sold Through Proxy Services - BankInfoSecurity
Researchers Find Residential Proxies on White House Network - SecurityWeek