White House Network Appears in Residential Proxy Data, Raising Questions About Hidden Device Risks

Security firm Layer3 Intel reports that devices associated with the White House network appear to be serving as residential proxy exit nodes. Residential proxies route internet traffic through IP addresses tied to home-style connections rather than datacentres, which hides where the user really is. Many such services are legitimate, but criminals also use them to conceal command-and-control infrastructure, run phishing campaigns, send spam and disguise malicious traffic, as an FBI bulletin warned in March.

Layer3 says its data shows 28 distinct residential proxy services exiting into the White House network almost daily between October 5 and November 3, with 236 separate exits in that period. Other detection services logged the same activity, according to the firm. Most of it occurred between 5 pm and midnight, White House time. Layer3 believes this points to an infected device used by someone who works there, rather than a guest, likely via a compromised proxy SDK (a software component that can quietly turn a device into a proxy). The source does not confirm how it happened.

The concern is what could follow. Layer3 notes that past research has shown poorly secured proxy SDKs can allow internal network access and lateral movement. If an SDK on this network has a similar flaw, anyone buying proxy access could potentially reach internal systems. The FBI warns that devices can be turned into nodes without consent through malware, illicit SDK partnerships and VPNs with hidden service terms.