White House Network Exposed to Rentable Residential Proxies

Security experts have warned that several White House staffers are using devices equipped with residential proxy services that allow their internet addresses to be rented by third parties. This practice exposes the Executive Office of the President’s network to unauthorized access, with one implicated service linked to a Russian founder whose company was a launchpad for cyberattacks on US election systems in 2016.

What happened

According to Krebs on Security, the security firm Layer3 Intel detected multiple residential proxy nodes beaconing from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 reported that this activity was persistent between October 5 and November 3, with proxy exits occurring 236 times from the White House network during that period. The activity originated from six specific internet addresses on 26 of the 30 days, primarily between 5 p.m. and midnight.

The proxy tracking company Synthient identified the software as Infatica, a proxy program often integrated into free mobile and desktop applications. Synthient noted that Infatica’s founder, Vladimir Fomenko, is a Russian national whose hosting firm, King Servers, hosted six of the eight internet addresses used by Russian state security services to compromise election databases in Arizona and Illinois in 2016. Layer3 Intel further stated that 28 separate residential proxy services were able to exit through the White House network. Ben Brundage, founder of Synthient, told KrebsOnSecurity that resellers can sell bandwidth for as low as 60 cents a Gigabyte, allowing criminals to bypass Know Your Customer processes. The White House did not immediately respond to a request for comment.

Why it matters for small company owners

This incident is not just a government failure; it is a direct warning to small and mid-sized businesses that rely on consumer-grade software and employee-owned devices. The root cause here is the monetization of user bandwidth through embedded SDKs in "free" applications, a practice that is prevalent across the tech ecosystem. For a small company, this means that a free productivity tool or a mobile app installed on a staff member’s laptop could be quietly renting out your office IP address to strangers. This creates a dual threat: first, your network traffic is anonymized and routed through third-party infrastructure, potentially violating data privacy regulations; second, your IP address becomes a vehicle for cybercrime, account takeover, or AI data scraping, which can blacklist your business domain or invite malicious traffic directed at your infrastructure. The fact that 65% of Infoblox’s customer base queried residential proxy domains, as reported in the same article, indicates this is a systemic industry-wide issue, not an isolated anomaly. Small companies often lack the dedicated IT security teams to detect these subtle background processes, making them vulnerable to the same "shadow IT" risks that compromised the White House network.

What to do this week

1. Audit all employee devices for known residential proxy SDKs like Infatica, PacketStream, or similar bandwidth-sharing software, and uninstall any applications that bundle these services.
2. Configure your network firewall to block outbound traffic to known residential proxy exit nodes and restrict internet access from non-corporate, personally-owned devices to prevent unauthorized bandwidth sharing.
3. Implement a strict software allow-list policy that prohibits the installation of unvetted "free" applications on business equipment, requiring IT approval for any new software that requests network or system-level permissions.

Sources

• Want to Rent an Internet Address at the White House? — Krebs on Security