Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

236 Residential Proxy Exits Detected from White House Network

9 sources · 9 articlesFirst reported Updated ()1
What's new

November 6: Security Affairs adds similar proxy activity in Antarctica McMurdo Station and Saint Helena; CSO Online notes potential for DDoS or malware distribution.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Layer3 Intel observed 236 proxy exits from six Executive Office addresses on AS2650 between October 5 and November 3, 2026, via 28 services, likely from infected devices.

Layer3 Intel detected residential proxy traffic exiting the Executive Office of the President's AS2650 network 236 times from six addresses on 26 of 30 days between October 5 and November 3, 2026. The exits routed through 28 residential proxy services, with activity peaking in the evenings between 5 p.m. and midnight Eastern Time. Researchers link the pattern to compromised devices running proxy SDKs such as Infatica or Rave.io on Windows 10/11 machines, raising risks of lateral movement, though no system compromise was reported. Logs were backed up and shared with US agencies including the State Department.

Key facts
  • 236 proxy exits from 6 addresses on 26 of 30 days
  • 28 residential proxy services involved
  • Activity peaks 5pm-midnight ET
  • Likely from infected devices using Infatica or Rave.io SDKs
  • Logs shared with State Department
  • Similar activity in Antarctica McMurdo Station
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 5, 2026Proxy activity begins from October 5 · Layer3 Intel
  2. Oct 5, 2026To 2026-11-03 proxy exits observed · Multiple reports
  3. Nov 4, 2026Most recent activity noted · Layer3 Intel
  4. Nov 6, 2026Logs shared with State Department · Infosecurity Magazine
  5. Nov 6, 2026Similar activity reported in Antarctica · Security Affairs

What each outlet adds

beyond the shared facts
  • Help Net SecurityLinks activity to Rave.io app and Antarctica proxies
  • The RegisterContinuous use since July; State Department requested logs
  • Cyber Security NewsSpur and Synthient also flagged the addresses
  • SecurityWeekInfaticaSDK on Windows 11 machines
  • CSO OnlinePotential for DDoS or malware distribution
Vendors
Layer3InfaticaLayer3 IntelSynthient
Products
residential proxy servicesResidential Proxy ObservatoryInfaticaSDK
Malware
Kimwolf
Victims
Executive Office of the Presidentwhite houseWhite House
Organizations
Layer3 IntelSpurSynthientExecutive Office of the PresidentWhite Houselayer3 intelsynthient
Countries
United Statesrussia

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Lobsters · securityFirst report

    Residential proxies detected on White House network

    Proxy exits recorded 236 times from six addresses October 5 to November 3, 2026, raising lateral movement risks via SDK flaws.

  2. · 4d ago Krebs on Security

    White House network used for renting internet addresses via proxies

    Residential proxies from Russian-linked services detected beaconing from the Executive Office of the President network, risking potential data exposure.

  3. · 4d ago Cyber Security News

    White House network addresses rented through 28 proxy services

    Layer3 Intel logged 236 exits from six Executive Office addresses on 26 of 30 days from October 5 to November 3.

  4. · 4d ago Infosecurity Magazine

    Residential proxy exits traced to White House network addresses

    Layer3 recorded 236 exits via 28 proxy services on six addresses in AS2650, with no system compromise reported.

  5. · 3d ago The Register · Security

    White House network used as residential proxy exit spot

    Devices on the White House network appear to be serving as residential proxy exit nodes, raising risks of lateral movement into internal systems via potentially vulnerable SDKs.

  6. · 3d ago Help Net Security

    White House network serves as exit point for residential proxy services

    Layer3 Intel detected proxy traffic exiting White House network 236 times in October, linked to infected devices running Rave.io proxy SDK.

  7. · 3d ago SecurityWeek

    White House Network Hosts Residential Proxy Exit Nodes

    Layer3 Intel identified proxy exit nodes on the Executive Office of the President network used by 28 services.

  8. · 3d ago CSO Online

    Residential proxies activity detected in White House network

    Residential proxies appear on AS2650, the network for the US President's executive office, potentially for illicit uses like DDoS or malware.

  9. · 2d ago Security Affairs

    White House network shows residential proxy exits

    Layer3 detected residential proxy traffic exits on White House network AS2650 between Oct 5 and Nov 3.