White House Network Exposed as Residential Proxy Services Turn Government Devices into Global Exit Nodes

In a startling breach of digital perimeter security, cybersecurity researchers have identified that numerous computers and mobile devices connected to the Executive Office of the President’s private network have been unknowingly functioning as residential proxy exit nodes. This configuration allows third parties—including anonymous actors, cybercriminals, and foreign entities—to route their internet traffic through White House-assigned IP addresses, effectively masking their true origin and bypassing standard security filters.

The findings, reported by the security firm Layer3 Intel, reveal that the Executive Office of the President’s dedicated internet network, identified by the Autonomous System Number AS2650, has been broadcasting residential proxy signals persistently. Between October 5 and November 3, investigators documented 236 instances where traffic originating from within the White House network was redirected to external servers through these proxy services.

The Russian Connection and the Infatica Link

The investigation has pinpointed a specific proxy provider, Infatica, as a primary culprit in this exposure. The program, which often integrates into otherwise legitimate-looking desktop and mobile applications, appears to have been installed on various Windows 11 devices operating within the White House infrastructure.

The implications of this discovery are magnified by the background of Infatica’s founder, Vladimir Fomenko. Fomenko is the owner of King Servers, a hosting firm that gained international notoriety in 2016 for its role in the coordinated cyberattacks against U.S. election infrastructure. During that campaign, six of the eight IP addresses identified by intelligence agencies as staging points for the breach of Illinois and Arizona voter databases were traced back to Fomenko’s infrastructure. The presence of his current software within the most secure executive network in the United States raises profound questions regarding supply chain security and the vetting of software permitted on government hardware.

Timeline of Detected Activity

The persistence of the proxy beaconing suggests a long-term, systemic oversight in network hygiene. According to the data provided by Layer3 Intel, the activity was not a one-time anomaly but a recurring pattern.

• October 5 – November 3: Layer3 Intel detected consistent proxy activity.
• Daily Patterns: Analysis shows that traffic spikes occurred primarily during evening hours, typically between 5 p.m. and midnight. This pattern strongly suggests that the proxy services are active on government-issued or employee-owned devices while they are connected to the White House network, likely outside of standard administrative oversight hours.
• Network Probes: Researchers observed that the proxy exit nodes utilized six distinct internet addresses within the AS2650 range, with activity detected on 26 of the 30 days monitored.

The Mechanics of Residential Proxy Abuse

Residential proxy networks operate by pooling the bandwidth of thousands of unsuspecting users. By embedding software development kits (SDKs) into "free" apps—ranging from VPNs to weather trackers and gaming tools—these proxy providers gain remote access to a user’s local network. Once installed, the user’s device acts as an "exit node," allowing paying customers to purchase access to that specific residential IP address.

From the perspective of a target website, traffic routed through these nodes does not appear to come from a data center or a suspicious server; it appears to originate from a home or, in this case, a high-value government office. This grants the end-user a "cloak of legitimacy," enabling them to perform credential stuffing, account takeovers, advertising fraud, and large-scale data scraping without triggering traditional security alerts.

"This is public access," stated the research team at Layer3 Intel in their public disclosure. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars, and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services."

Broadening the Scope: A Pervasive Security Failure

While the White House case represents the most sensitive instance of this vulnerability, it is far from an isolated incident. The proxy tracking service Spur recently conducted a comprehensive audit of digital infrastructure and found residential proxy nodes active in nearly 300 government-operated networks. Furthermore, the reach of these services extends deep into critical infrastructure:

• Utility Providers: 318 utility companies identified with active proxy nodes.
• Healthcare: 166 hospitals and healthcare providers identified.
• Financial Services: 141 institutions in the banking and finance sector were found to have compromised network endpoints.

These findings align with data from the security firm Infoblox, which reported that 65% of its corporate client base queried one or more domains associated with residential proxy services. The economic incentive for this activity is stark; as Ben Brundage, founder of the tracking firm Synthient, noted, bandwidth can be purchased for as little as 60 cents per gigabyte. For less than a dollar, an adversary can effectively "rent" a foothold in some of the most protected networks in the world, often bypassing standard Know Your Customer (KYC) requirements.

Emerging Risks: From Anonymity to Malware Delivery

The threat posed by residential proxies has evolved significantly over the past 24 months. Beyond simple anonymization, these services are increasingly being weaponized to perform internal network reconnaissance.

In late 2025, security researchers uncovered a vulnerability within the proxy SDKs themselves. Attackers realized that by sending specially crafted packets to a proxy node, they could force the host device to scan its own local network for vulnerable systems. This tactic allows an attacker to pivot from a public-facing proxy node to an internal, highly sensitive network environment, effectively turning the proxy software into a persistent remote-access trojan (RAT).

In January 2026, the severity of this risk reached a breaking point when dozens of proxy services were forced to issue emergency patches following revelations of the "Kimwolf" botnet, which used these vulnerabilities to seize control of devices within private local networks.

Official Response and Institutional Implications

As of the time of publication, the White House has not issued a formal statement regarding the specific findings involving the AS2650 network. However, cybersecurity experts emphasize that the incident highlights a critical failure in "Shadow IT" management—the use of unauthorized software or services within an enterprise environment.

The presence of these proxies on government devices implies that employees are likely installing third-party applications on systems that have access to classified or sensitive communications. These applications, under the guise of providing free services, are monetizing the user’s connection by selling access to the government network’s bandwidth.

Analysis: A Call for Policy Reform

The incident serves as a sobering reminder of the interconnected nature of modern digital threats. When a device inside a secure perimeter is transformed into a proxy node, the boundary of that perimeter effectively evaporates.

"The reseller ecosystem enables this, with any criminal able to buy access while skipping KYC processes," says Brundage. For government agencies, the solution is multifaceted. It requires more than just firewall rules; it necessitates strict device management policies that prohibit the installation of unvetted software, as well as active monitoring for unusual egress traffic patterns that characterize proxy node beaconing.

Until such policies are strictly enforced, the White House and other critical infrastructure entities remain vulnerable to an invisible, low-cost, and highly effective form of digital subversion. The ease with which researchers were able to discover this activity underscores that it is not a sophisticated "zero-day" exploit being used by state-level actors, but a common, commercialized service being utilized in an environment where it has no place. The exposure of the Executive Office of the President’s network is a critical bellwether for the broader cyber-defense community, signaling that the battle for network integrity is no longer just against hackers—it is against the very applications that are becoming an ubiquitous part of the digital landscape.