On Wednesday, security firm Layer3 reported that it has found residential proxy services routing traffic through IP addresses assigned to the White House network, suggesting devices connected to that network are running software that allows their internet connections to be rented out to strangers, potentially through free apps installed on computers or phones.
Residential proxy services sell access to phones and computers used by normal people so a customer’s traffic appears to come from those devices’ internet addresses. Cybercriminals often buy that access so their activity looks like ordinary home or office traffic, and the White House addresses Layer3 found are the same kind sold on public residential proxy services that anyone can purchase. In fact, Layer3 said it saw those exit addresses across 28 separate services.
Synthient founder Ben Brundage told Krebs on Security that some resellers “sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks.” He added that “the reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.”
White House Network Exits Showed Up in Public Proxy Pools
Layer3 said its Residential Proxy Observatory noticed exit traffic on AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. Between October 5 and November 3, Layer3’s monitoring pipeline exited through that network 236 times, using six different IP addresses on 26 of those 30 days. The firm said it was not targeting the White House. Instead, it caught the exits by requesting global rotating access from public providers and later cross-checked the addresses against Spur and Synthient, which independently flag them as residential proxy exits.
“This is public access. Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it,” Layer3 wrote. About half of the observations fell between 5 p.m. and midnight Eastern time, with almost none in the early morning, a pattern Layer3 reads as someone regularly on the network in the evening with a device running a proxy software development kit (SDK). “Our data shows the exits, not the device or the person behind them,” the firm added.
To be clear, researchers have not said this was malware planted to spy on the White House. App developers often embed residential proxy SDKs to monetize free apps, earning a small fee per install while the device’s bandwidth is rented out. Those free-app installs can then beacon from employee devices brought into the workplace.
🧵 1/N
With high confidence we believe the installed app to be Rave[.]io a shared streaming app that bundles 12 proxy SDKs into the platform. https://t.co/PKhesNr8xu pic.twitter.com/VdTUaLuWB0— Synthient (@synthient) November 5, 2026
Synthient initially tied the White House network activity to Windows machines running InfaticaSDK, a proxy program often integrated into free mobile and desktop applications. The proxy tracker now says it believes with high confidence that the installed app is Rave, a shared streaming app that bundles numerous proxy SDKs. Synthient said it detected Windows 10 and Windows 11 devices communicating with Geonode, Infatica, and Mellowtel, and that a VirusTotal search for Windows apps containing all three SDKs identified only Rave.
It’s worth considering what a poorly secured proxy SDK can do beyond renting a trusted IP address. Krebs noted that in late 2025, criminals mass-exploited widespread flaws in these kinds of services that let them probe each proxy endpoint’s local network for systems to infect. In January, many proxy services had to patch after Brundage showed how those flaws could be abused to seize control of devices inside users’ local networks. If a proxy SDK on a sensitive network, such as the White House’s, had a similar flaw, it could potentially allow customers to reach other systems on the local network, provided those systems weren’t otherwise isolated or protected.
Other Residential Proxy Nightmares
Earlier this week, Google’s Threat Intelligence Group said it had dismantled the XCPE backdoor, which enrolled more than 1.3 million set-top boxes, mostly Android TV devices, into a botnet that Google assesses with high confidence was intentionally developed and operated for financial gain by Android hardware manufacturer Videostrong Technology Co. Modules silently enrolled infected boxes into residential proxy networks, among other abuses. “We believe this campaign wasn’t an isolated rogue insider or a development oversight,” Google wrote.
Last month, researchers also observed attackers exploiting a vulnerability in Plex Media Server to deploy residential proxy software. After the Plex2Shell remote code execution chain became public, an operator running a deliberately vulnerable server as a honeypot saw attackers install a cryptocurrency miner and myawesomeproxy residential proxy software.
Nation-state operators take advantage of what residential proxy networks can hide as well. For example, Russian espionage actors have reportedly routed traffic through Americans’ home networks to mask cyber operations. North Korea has taken that strategy further with human proxies and laptop farms that let North Korean IT workers use U.S. machines, a scheme that recently led to FBI raids on more than 40 Texas homes and charges against Americans accused of helping run it.
