White House Network Exposed Via Residential Proxy Services
White House staffers are inadvertently renting out their internet addresses through residential proxy services, exposing the Executive Office of the President's network to potential exploitation.
Multiple White House staffers are unknowingly exposing the Executive Office of the President's (EOP) network by using computers or mobile devices equipped with residential proxy services. These services allow their internet addresses to be rented by third parties, creating a significant security risk. Security researchers detected persistent activity from at least 28 different proxy services, including one linked to Russia, exiting the EOP's network.
Layer3 Intel, a security firm, observed multiple residential proxy nodes beaconing out from the EOP's dedicated internet address network (AS2650) between October 5 and November 3. During this period, these proxy services exited the White House network 236 times. The activity was particularly noticeable in the evenings, between 5 p.m. and midnight, and occurred on 26 out of 30 days.
One of the most prominent services identified was Infatica, a Russian company whose founder, Vladimir Fomenko, has a history tied to cyberattacks. Fomenko's hosting firm, King Servers, was previously used to host infrastructure for Russian state security services involved in compromising election systems in Arizona and Illinois in 2016. This connection raises serious concerns about the potential for malicious actors to leverage the White House network.
Residential proxy services operate by allowing users to rent IP addresses from individuals who have installed proxy software, often embedded in free applications. From a website's perspective, traffic appears to originate from the rented IP address, effectively anonymizing the proxy service customer's true location and identity. This makes it difficult to trace malicious activities back to their source.
The implications of this exposure are far-reaching. Malicious actors could use these rented IP addresses to anonymize their own traffic, conduct cybercrimes, scrape sensitive data, or even attempt to probe for vulnerabilities within the EOP's internal systems. The ease with which these services can be accessed – with some offering bandwidth for as little as 60 cents per Gigabyte – lowers the barrier for entry for potential attackers.
This incident highlights a broader trend of residential proxy services being found on government and corporate networks. A previous report indicated that nearly 300 government-owned networks, numerous utility companies, healthcare providers, and financial institutions also had residential proxy activity. The practice often stems from employees using personal devices or from applications embedding SDKs from proxy networks to monetize their software.
In late 2025 and early 2026, vulnerabilities in residential proxy services were exploited, allowing cybercriminals to scan local networks for vulnerable systems and even seize control of devices. The lack of stringent Know Your Customer (KYC) processes within the reseller ecosystem further exacerbates these risks, enabling criminals to easily purchase access.
The White House has not yet responded to a request for comment. This situation underscores the critical need for robust network security policies and employee awareness training to prevent the inadvertent exposure of sensitive government infrastructure.