Residential proxies detected on White House network

If you use or interact with any White House network, it may be exposed to unauthorized access through infected devices.

Layer3 Intel, a cybersecurity firm, announced the detection of residential proxy activity originating from the White House network. Using their newly launched Residential Proxy Observatory, researchers observed traffic from the Executive Office of the President's network (AS2650) appearing as residential proxy exits on 26 out of 30 days between October 5 and November 3, 2026. A total of 236 exits were recorded from six distinct IP addresses, representing 28 different residential proxy services. This activity was confirmed by other detection services, Spur and Synthient. The pattern of activity, largely occurring in the evening, suggests it could stem from an infected device on the network rather than public Wi-Fi. Such infections, if stemming from poorly secured proxy SDKs, could potentially grant external access to internal White House systems, mirroring tactics used by past botnets. The firm also noted widespread residential proxy activity in extremely remote locations globally.

The detection of residential proxies on the White House network is a significant security concern, highlighting potential vulnerabilities within a critical government infrastructure. The observed traffic pattern suggests a human element, potentially an infected device running a malicious SDK, which could allow for lateral movement within the network and access to sensitive internal systems. This incident underscores the pervasive threat of residential proxy networks, which can be exploited by malicious actors to gain unauthorized access, as demonstrated by past botnet campaigns.

This event emphasizes the growing challenge of securing government networks against sophisticated, yet accessible, exploitation methods. The ease with which these proxies were detected and the broad reach of residential proxy services globally suggest that similar vulnerabilities may exist across numerous sensitive networks. Organizations must prioritize robust endpoint security and network segmentation to mitigate the risks posed by compromised devices within their perimeters.