Threat IntelligenceEmerging Threats

White House Network Exits Traffic Through Residential Proxies

Analyst 207||Source: InfoSecMag
Daytime scene of residential street outside White House with subtle network infrastructure in background.

236 times over a 30‑day span, residential proxy traffic exited through internet addresses tied to the White House network, according to a New York firm that uncovered the pattern in early November.

Layer3 Intel: scope, method and verification

Layer3 Intel, a New York‑based residential proxy detection firm, published research on November 4 reporting 236 recorded exits through six addresses over a 30‑day window. The firm’s newly launched Residential Proxy Observatory logged exits on 26 of the 30 days between October 5 and November 3. Layer3 said it discovered the activity by chance while requesting ordinary global rotating access from public residential proxy services.

The firm identified 28 separate residential proxy services able to route traffic through those addresses. Layer3 cross‑checked the addresses against public lookup pages from two independent proxy detection services, Spur and Synthient, which also identified them as residential proxy exits.

AS2650: the addresses and their registry

The six addresses sit in AS2650, the autonomous system block registered to the Executive Office of the President, the federal agency that hosts the White House network, Layer3 reported. The firm emphasized that the observed data are exits — the points where proxy traffic was routed onto the public internet — and not an identification of any device or individual.

Timing, pattern and the single‑device hypothesis

Layer3’s timeline showed a clear daily pattern: roughly half of the observed proxy exits occurred between 5:00 p.m. and midnight Eastern Time, with almost no activity in the early morning hours. The firm suggested that the cadence pointed toward a regularly used personal device rather than an open guest Wi‑Fi network, and said the activity was consistent with a device that had been infected with a residential proxy software development kit (SDK).

“Our data shows the exits, not the device or the person behind them,” Layer3 wrote, and founder Sergiy Usatyuk told Infosecurity: “The most recent activity was recorded in the evening of November 4; hopefully, it stops soon!”

Proxy SDK risks and a recent botnet precedent

Layer3 did not report any confirmed compromise of White House systems. It backed up raw logs of the activity and shared its findings with a US federal agency, according to the firm.

Layer3’s report invoked prior research showing that poorly secured proxy SDKs can create pathways into internal networks and enable lateral movement. The firm cited Synthient’s research into the Kimwolf botnet, which Synthient reported had reached at least two million devices — largely Android devices with an exposed Android Debug Bridge (ADB) service — via residential proxy networks. Layer3 warned that if a proxy SDK on the White House network contained similar flaws, anyone buying access from a residential proxy service could potentially use those exits to reach internal systems.

What this means for the White House, a US federal agency, and security teams

  • White House: The addresses at issue are within AS2650, the block registered to the Executive Office of the President. Infosecurity has contacted the White House for comment; Layer3 reported it has shared raw logs with a US federal agency to support any follow‑up.
  • A US federal agency: Layer3 provided raw logs to a federal agency, giving that agency concrete data to review the recorded exits and assess whether remediation or further forensic work is necessary.
  • Security teams and technologists: The incident underscores that commercial residential proxy services can route traffic through high‑profile networks and that proxy SDKs — when insecure — have been linked to large‑scale botnet activity such as Kimwolf, per Synthient research cited by Layer3.

Layer3’s discovery leaves two clear, immediate facts on the record: the exits were observed repeatedly across late evenings, and the firm preserved and shared logs with federal authorities. Beyond those facts, the apparent evening‑hour concentration and the firm’s SDK hypothesis frame a focused set of follow‑up questions for the agency that received the logs and for the network operators responsible for AS2650.

Infosecurity has contacted the White House for comment; as of Layer3’s publication on November 4 the firm reported recent activity as late as the evening of November 4. The record now rests with the raw logs Layer3 backed up and the federal agency reviewing them — whether that review will produce further disclosure, remediation, or additional public detail remains to be seen.

Original Infosecurity story

Emerging ThreatsNetwork SecurityUs GovernmentWhite HouseResidential ProxyProxy TrafficTraffic Exfiltration
Related Intelligence

Continue Reading

Dimly lit server room with rows of rack-mounted servers and a single unoccupied workstation in the foreground.

Linux Servers Targeted by Stealthy CWPdoor Backdoor Malware

Over 340,000 Linux servers are at risk after a new backdoor malware called CWPdoor was discovered, targeting open-source web hosting administration solutions like CentOS Web Panel. This stealthy threat can give attackers control of vulnerable servers, allowing them to wreak havoc on your digital operations.

Analyst 207
Server room interior with rows of equipment and a highlighted, blurred-out panel on one rack.

DigiCert Breach Exposes Customer Data, Identity Documents

DigiCert's recent data breach left customers reeling after archived records and sensitive identity documents were mistakenly exposed to the internet, thanks to a server migration gone wrong. The blunder allowed external users to create accounts and access private data, including full PII information and verification documents.

Analyst 207
Dimly lit server room interior with rows of racks, cables on the floor, and out-of-focus network equipment in the foreground.

Storm-2603 Exploits SharePoint Flaw for Fileless Breach

In a sneaky move, hackers exploited a SharePoint flaw to launch a fileless breach, loading their payload directly into the ASP.NET runtime and leaving no digital footprint behind. The attack unfolded over several days, with initial fingerprinting on December 20 and a full remote code execution achieved by December 24.

Analyst 207
Blurred laptop screen on a desk in a brightly-lit office suggests a cyber attack.

India Warns of AI-Driven Cyber-Attacks Targeting Financial Firms

India's cyber security team has warned that financial firms are under attack by a sophisticated AI-driven threat, dubbed "Crafty Falcon", that's exploiting incomplete security measures to gain repeated access to sensitive systems. The threat actor has already targeted non-banking financial companies, digital lenders, fintech firms, and crypto platforms across the country.

Analyst 207