Residential Proxies Found on White House Network
Original: Residential proxies detected on White House network
Why This Matters
Compromised devices inside sensitive government networks are a known APT vector.
Cybersecurity firm Layer3 Intel detected residential proxy exit activity on AS2650, the Executive Office of the President's network, 236 times across 26 days in October–November 2026, involving 28 separate proxy services and 6 IP addresses.
Layer3 Intel, using its newly launched Residential Proxy Observatory, stumbled onto something unexpected while browsing global proxy exit data: confirmed proxy activity originating from AS2650, the autonomous system registered to the Executive Office of the President — the network that hosts the White House. Between October 5 and November 3, 2026, the firm recorded 236 exits from 6 addresses over 26 of 30 days, routed through 28 distinct residential proxy services. Independent verification from Spur and Synthient corroborated the findings. The activity pattern is what raises flags: roughly half the exits occurred between 5 p.m. and midnight Eastern time, with almost none in the early morning hours — a schedule consistent with a person using the network regularly in the evenings rather than a public Wi-Fi hotspot. Layer3 Intel did not target the White House specifically; the exits were caught incidentally via rotating global proxy access. Residential proxy SDKs, often bundled into apps without user awareness, can expose internal network segments to anyone paying a few dollars for proxy access. Synthient's prior research on the Kimwolf botnet showed how such SDKs enabled lateral movement across roughly 2 million compromised devices. The firm notes it observed exit points only — not the specific device or individual involved.