NewsPublished 6 Nov 2026

Researchers Find Residential Proxies on White House Network

Source SecurityWeek

Description

Security researchers discovered that six IP addresses within the White House network were used as exit nodes by 28 residential proxy services over a month. The proxy activity mainly occurred in the evenings, suggesting a device regularly connected during those hours may be infected with proxy software. The traffic originated from Windows 11 machines running the InfaticaSDK, a proxy service provider. This finding indicates that devices on a sensitive government network may be unknowingly facilitating proxy traffic for external users.

Impact

The presence of residential proxy exit nodes on the White House network could allow external actors to route traffic through these government IP addresses, potentially masking malicious activities or evading detection. This could undermine network security and confidentiality, as infected devices may be exploited to facilitate unauthorized proxy services. However, no direct exploitation or attack has been confirmed. The activity pattern suggests an infected device rather than a systemic network compromise.

Defensive guidance

Organizations should investigate the identified IP addresses and devices for signs of infection with proxy SDKs like InfaticaSDK. Removing or isolating infected devices and monitoring for unauthorized proxy traffic is recommended. Since this involves a sensitive government network, internal incident response and forensic analysis should be conducted to identify and remediate the infection source.

Summary

Between October 5 and November 3, 2026, Layer3 Intel identified six IP addresses on AS2650, the network reserved for the Executive Office of the President, being used as exit points for 28 residential proxy services. These proxy exits were observed 236 times, predominantly between 5 p.m. and midnight Eastern Time. The activity pattern suggests a single user or device rather than a public network. Cybersecurity startup Synthient attributed the traffic to Windows 11 machines running the InfaticaSDK, a proxy service provider with a history linked to infrastructure used in past Russian state-sponsored attacks. This situation implies that devices on the White House network may be infected or compromised to act as residential proxy nodes, potentially exposing the network to misuse or surveillance risks.

References

securityweek.com/researchers-find-residential-proxies-on-white-house-network/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Nov 2026, 12:33 UTC

Technical details

References

Community reviews