Residential Proxy Traffic Detected Leaving White House Network Suggests Compromised Endpoints
What Happened — Between 5 Oct and 3 Nov 2026, Layer3 Intel’s proxy‑enumeration pipeline observed 236 outbound connections from IP blocks registered to the Executive Office of the President (AS 2650). The traffic exited through six distinct White House addresses on 26 of the 30 days and was routed to 28 separate residential‑proxy services. Residential proxies make traffic appear to originate from everyday consumer devices; in this case, internal White House traffic would appear to come from a residential IP.
Layer3 did not target the network; the activity was discovered while testing global rotating proxy access. Independent proxy‑detection services flagged the same IPs as residential‑proxy exits, confirming the observation. The timing (mostly 5 pm‑midnight ET) led researchers to infer that a user working late on the White House network had a device infected with a proxy SDK. Subsequent analysis by Synthient identified Windows 10/11 machines beaconing to known proxy providers (Geonode, Infatica, Mellowtel) and attributed the SDK bundle to the streaming app Rave.io, which includes multiple proxy components. No direct evidence of data exfiltration was presented, but the presence of compromised endpoints creates a viable path for external actors to reach internal systems.
Why It Matters for Trust & Control Assurance — The episode highlights gaps in continuous endpoint monitoring and auditable logging—control objectives that map to multiple frameworks (e.g., NIST CSF 2.0).
Who Is Affected — Federal executive offices, government IT staff, and any agency relying on the same network infrastructure.
Recommended Actions
- Deploy endpoint detection and response (EDR) with strict outbound proxy controls.
- Centralize network logs and enable real‑time alerts for anomalous outbound traffic to residential‑proxy IP ranges.
- Conduct forensic analysis of the identified Windows devices, remove unauthorized SDKs, and harden application whitelisting.
- Review and update remote‑access policies to prohibit unsanctioned proxy usage.
Source: Help Net Security
Technical Notes
- Attack vector: Malware‑based proxy SDK installed on internal Windows 10/11 workstations.
- Data types at risk: Potential access to internal communications, documents, and credential stores.
- Detection tools: Layer3 Intel Residential Proxy Observatory, Synthient proxy‑detection service.