The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found.
In a blog post, the threat intelligence firm reported that its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3. The exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route.
Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device’s network. Here, customers’ traffic would appear to come from inside the White House.
“This is public access,” the Layer3 Intel team noted. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.”
The firm stressed that it did not target the network or try to make its probes exit from it. Its staff spotted the activity while looking through the company’s Residential Proxy Observatory, simply by requesting global rotating access through the proxy services. To rule out a fluke, they checked the addresses against other proxy detection services, whose public IP pages independently flag them as residential proxy exits.
Someone working late
The timing of the traffic gave Layer3 a hint about its source. About half of it falls between 5 p.m. and midnight Eastern time, and almost none happens in the early morning.
The company believes this pattern indicates “someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK.” Its data shows only the exits, though, and nothing about the device or the person using it.
“Someone that is at the Whitehouse between 5pm and midnight has some compromised devices. Or at least some that are providing residential proxy access to botnets,” security researcher Matt Johansen posted on X.
A streaming app in the frame
Synthient, one of the detection services Layer3 used to verify the addresses, went further. On November 4 it claimed that “several Whitehouse staffers are running a Windows 11 machine with InfaticaSDK installed.”
A day later, the company explained that it can detect devices on a per session basis, and that this revealed “a number of Windows 10 and Windows 11 devices beaconing to known proxy providers like Geonode, Infatica and Mellowtel.”
“With high confidence we believe the installed app to be Rave[.]io a shared streaming app that bundles 12 proxy SDKs into the platform,” Synthient stated. Rave lets people watch videos together and runs on Mac, iPhone, Android and Windows.
A possible way into internal systems
Layer3 cited past research showing that poorly secured proxy SDKs can give outsiders access to internal networks and let them move laterally.
“This is how past botnets have spread. In A Broken System Fueling Botnets, the researchers at Synthient documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks,” the company wrote.
“If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems,” they cautioned.
From the White House to Antarctica
The observatory turned up proxies in some of the most isolated places on Earth. Layer3 recorded 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha, the South Atlantic territory that includes the most remote inhabited island in the world.
Three observations came from Antarctica, all from a Cloudflare WARP address tied to McMurdo Station.
“Residential proxies have infected every corner of the world, and it looks like there is no place they cannot reach,” the company concluded.
