Security researchers have uncovered that several White House staffers are running residential proxy services on their computers and mobile devices, effectively turning the presidential network’s IP addresses into a rental market for anyone willing to pay a few dollars.
Layer3 Intel traced 236 proxy exit events from the Executive Office of the President’s dedicated network (AS2650) between 5 October and 3 November. The firm found that the traffic was generated by 28 separate residential proxy providers, with six distinct IP addresses used on 26 of the 30 days in that period. Most of the activity occurred between 5 p.m. and midnight.
One of the services identified was Infatica, a proxy program that is often bundled into “free” Windows 11 applications. Infatica’s founder, Russian entrepreneur Vladimir Fomenko, runs a hosting company called King Servers, which was the base for six of the eight IP addresses used by Russian state‑security services to compromise election systems in Arizona and Illinois in 2016.
“This is public access,” the Layer3 Intel team wrote. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.”
“Some of these resellers sell bandwidth for as low as 60 cents a gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks,” said Synthient founder Ben Brundage. “The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC processes.”
Residential proxies are widely used across government, utility, healthcare and finance sectors. A 2026 webinar by Spur found such proxies in nearly 300 government networks, 318 utilities, 166 healthcare organisations and 141 banking firms. The practice poses significant security risks, including account takeovers, advertising fraud and the potential for malware to spread through vulnerable local networks. The White House has not yet responded to requests for comment.
<small>Source: Krebs on Security — read the original story there.</small>
