Cybersecurity researchers have reported the discovery of Residential Proxies activity operating within the White House's private network, a vulnerability that could allow third parties to rent access to route internet traffic through official IP addresses belonging to the presidential residence for amounts as low as a few dollars.
According to research findings by cybersecurity firms Layer3 Intel and Synthient, which were published by the Krebs on Security blog and The Register, devices within the White House network were observed exhibiting residential proxy behaviors. This technology works by redirecting the digital traffic of strangers through user devices within the network, allowing renters to hide the source of their actual activity and appear as if they are browsing from within the White House network.
Discovery Details and Temporal Patterns
Layer3 Intel stated that it detected 28 different residential proxy services routing traffic out of the White House network between October 5 and November 3. Researchers noted that this activity occurred regularly between 5:00 PM and midnight Eastern Time.
This temporal pattern suggests that the cause is not a public Wi-Fi network designated for visitors, but rather a personal device belonging to someone who is regularly present at the White House until late at night, and whose device is infected with a proxy software development kit (SDK). Synthient suggested that this software might be linked to concurrent viewing applications such as the Rave app, which integrates about 12 proxy service SDKs into its platform.
Synthient also detected a number of devices running Windows 10 and Windows 11 within the network beaconing to known proxy providers such as Geonode, Infatica, and Mellowtel. It is worth noting that the Infatica service was founded by Vladimir Fomenko, the owner of King Servers, a company whose name was linked to cyberattacks that targeted election systems in the states of Illinois and Arizona in 2016.
Why Does This Development Matter for Cybersecurity?
Residential proxy networks are used for legitimate purposes such as ad verification and software quality testing, but attackers and hackers exploit them on a large scale to bypass geolocation controls and official firewalls. These addresses are also used to build botnets and secure hacking operations and account takeovers.
The extreme danger in this discovery lies in the fact that the observed proxy services are publicly available; anyone can sign up for those services and pay small amounts to route their commands and traffic through the White House network, giving attackers a digital cover with high credibility that may bypass many defensive filters around the world.