Residential Proxy Traffic Traced to White House Network
Research by Layer3 Intel, published on November 4, recorded 236 residential proxy exits through the White House network over 30 days, via six AS2650 addresses used by 28 services. The evening pattern suggests a device running a proxy SDK, and the most recent activity was on the evening of November 4, according to Layer3's founder. Layer3 reported no compromise of White House systems; monitoring unusual outbound traffic is the recommended defense.
What happened
Research by Layer3 Intel recorded 236 residential proxy exits through the White House network between October 5 and November 3, across six addresses. Anyone could route traffic through the same exits by paying a few dollars to public proxy services. Layer3 reported no compromise of White House systems.
Why it matters
The timing pattern suggests a device inside the network ran a proxy SDK, letting outsiders use the institution's addresses. Past research shows poorly secured proxy SDKs can enable access to internal networks and lateral movement, as in past botnets.
What to do
Monitor unusual outbound traffic, review devices for installed proxy SDKs, and block unauthorized outbound traffic.
For the technical team
- Affected
- Casa Branca (governo dos EUA) Endereços da rede da Casa Branca usados como saída por proxies residenciais · White House network addresses in AS2650; potentially any device with a residential proxy SDK installed.
- Exploitation
- Active exits identified by Layer3 Intel on 26 of 30 days between October 5 and November 3, and independently confirmed via the public lookup pages of Spur and Synthient. Most recent activity reported on the evening of November 4 by founder Sergiy Usatyuk.
- Fix
- No specific fix cited; indicated mitigation is monitoring unusual outbound traffic and reviewing devices for proxy SDKs.
- Vector
- Traffic exits via six addresses in AS2650, the block registered to the Executive Office of the President, used by 28 residential proxy services. About half the activity fell between 5pm and midnight Eastern Time, a pattern Layer3 said suggests a person on the network with a device infected by a proxy SDK, rather than public guest Wi-Fi.
- More details
- Research published on November 4 in Layer3's newly launched Residential Proxy Observatory. The firm backed up raw logs and shared findings with a US federal agency. Layer3 cited Synthient research showing the Kimwolf botnet reached at least two million devices, mostly Android devices with an exposed Android Debug Bridge, through residential proxy networks. Layer3 notes its data shows the exits, not the device or person behind them. Infosecurity contacted the White House for comment.
Indicators (IoCs)
- AS2650
Timeline
Research shows 28 residential proxy services used 6 network addresses, mainly between 5 p.m. and midnight Eastern Time.
Incident opened.
Sources 2 sources
- Residential Proxy Traffic Traced to White House Network Infosecurity Magazine
- Researchers Find Residential Proxies on White House Network SecurityWeek
