Security Experts Warn White House Devices Exposed to Global Cyber Networks Through Residential Proxy Software

Federal cybersecurity and operational security are facing a silent, widespread, and deeply ironic threat from within: multiple computers and mobile devices utilized by White House staffers have been detected running residential proxy services that inadvertently—or carelessly—render their ultra-secure internet addresses available for global rent. According to independent security analysts, this configuration effectively turns portions of the Executive Office of the President’s dedicated network into open relays, allowing anonymous third parties across the world to mask their web traffic behind official United States government IP addresses.

The alarming discovery has brought renewed scrutiny to the multi-million-dollar underground ecosystem of residential proxy networks. More concerningly, security researchers have linked a portion of this traffic to a Russian-managed proxy firm with historical ties to state-sponsored attacks against American election infrastructure.

Detection and Scope of the Breach

The vulnerability came to light after security firm Layer3 Intel announced it had detected multiple residential proxy nodes beaconing outward from Autonomous System 2650 (AS2650), the specific internet address network reserved exclusively for the Executive Office of the President.

Layer3’s monitoring systems tracked this proxy activity over a nearly month-long observation window between October 5 and November 3. During this period, an automated review of available proxies within AS2650 revealed that proxy exit nodes successfully routed traffic out of the White House network a staggering 236 times.

Further analysis by the proxy tracking and intelligence firm Synthient corroborated these findings. Via public disclosures on social media, Synthient confirmed that the suspicious activity originating from AS2650 was directly tied to multiple Windows 11 installations running a service called Infatica. Infatica is a commercial proxy program that is frequently bundled or integrated into seemingly harmless "free" mobile and desktop applications through software development kits (SDKs).

Layer3 Intel’s investigation revealed that the proxy exit nodes at the White House operated across six distinct internet addresses. This activity was not an isolated incident; it was logged on 26 out of 30 consecutive days, with the vast majority of connections concentrated during evening hours, specifically between 5:00 p.m. and midnight.

Perhaps most astonishingly to investigators, Infatica is not the only culprit. Layer3 Intel reported identifying a total of 28 separate residential proxy services capable of routing traffic out through the White House network.

The Russian Connection and Historical Precedents

The involvement of Infatica introduces significant geopolitical and counterintelligence concerns. Infatica was founded by Vladimir Fomenko, a Russian national whose web hosting business, King Servers, previously served as the operational launchpad for sophisticated cyberattacks against United States democracy.

During the 2016 U.S. presidential election, King Servers infrastructure hosted six of the eight specific internet addresses utilized by Russian state-sponsored intelligence operatives to breach and compromise state voter registration databases in Arizona and Illinois. While there is no current evidence indicating that the presence of Infatica on White House devices represents an active state-sponsored espionage campaign, the structural overlap raises acute counterintelligence flags for federal security officials responsible for protecting executive branch infrastructure.

Mechanics of the Threat

Residential proxy networks operate on a simple yet inherently risky premise: everyday internet users download applications—often desktop tools, VPNs, or mobile games—that contain hidden background code. By accepting the terms of service, users unknowingly consent to turning their home or office internet connection into a "node" for a proxy network.

Customers of the proxy service—ranging from legitimate market researchers to malicious cybercriminals—pay a subscription fee to route their internet traffic through these residential nodes. To any targeted website, the traffic does not appear to originate from the proxy user. Instead, it appears to originate from the residential IP address of the node owner.

When this software is brought into a highly sensitive environment like the White House—often via personal laptops, smartphones, or employee-configured devices connected to internal networks—the paradigm shifts dangerously. Instead of routing traffic through a standard residential broadband connection in a suburban home, the proxy network inherits the high-trust, government-allocated IP address of the Executive Office of the President.

"This is public access," the Layer3 Intel research team wrote in a detailed technical blog post. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services."

As of press time, the White House has not formally responded to media requests for comment regarding the security findings.

A Broader Corporate and Government Epidemic

While the spotlight is currently on the White House, security experts emphasize that the presence of residential proxies on secure networks is a systemic crisis spanning private enterprise and public administration alike.

Residential proxy services have increasingly become the backbone of various malicious activities, including credential stuffing, account takeover attacks, advertising fraud, and massive data-scraping operations designed to fuel resource-hungry artificial intelligence models.

Beyond traffic laundering, these services introduce catastrophic security vulnerabilities. In late 2025 and early 2026, security researchers uncovered widespread exploitation of residential proxy architectures. Malicious actors discovered they could abuse vulnerabilities within proxy software to pivot backward—scanning the local networks of unsuspecting proxy hosts for vulnerable systems, corporate databases, or government endpoints to infect with malware.

Ben Brundage, founder of Synthient, highlighted the alarming affordability and lack of oversight in the proxy reseller market in an interview with security journalist Brian Krebs.

"Some of these resellers sell bandwidth for as low as 60 cents a gigabyte," Brundage noted. "That means for less than a dollar, you can gain access into some of the most confidential and trusted networks. The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes."

Data from threat intelligence firms underscores just how pervasive this issue has become. During a webinar held in January 2026, proxy tracking service Spur revealed that residential proxy nodes had been detected within nearly 300 government-owned and operated networks. Additionally, the software was found active across 318 utility companies, 166 healthcare organizations and hospitals, and 141 financial and banking institutions. Furthermore, infrastructure security firm Infoblox published findings indicating that a staggering 65% of its entire enterprise customer base had corporate networks querying one or more residential proxy-related domains.

Policy and Security Implications

The exposure of White House network assets through commercial proxy software underscores a glaring blind spot in modern endpoint management and mobile device policy. The blending of personal technology with secure government environments—often referred to as Bring Your Own Device (BYOD) or the informal use of unauthorized software on agency-issued hardware—creates massive apertures for malicious actors.

For federal cybersecurity agencies, the incident serves as an urgent wake-up call. The ability of everyday commercial software to inadvertently punch holes in the perimeter of the Executive Office of the President demonstrates that traditional perimeter defenses are no match for internal software supply chain risks. As nation-state actors and cybercrime syndicates increasingly leverage commercial proxy networks to bypass geographic blocks and IP reputation filters, federal networks will need to enforce stricter endpoint telemetry, application whitelisting, and continuous network behavioral monitoring to ensure that government IP addresses do not become unwitting accomplices in global cybercrime.