-
Layer3 Intel says strangers’ web traffic left through the White House network 236 times between October 5 and November 3.
-
The firm thinks one person’s device caused it, likely through hidden software. No breach has been confirmed.
-
This kind of software often hides in free apps. Researchers also find it on many government networks.
A security firm says a device on the White House network has been renting out its internet address. Layer3 Intel published its findings on November 4.
The company says anyone could buy access for a few dollars. So far, the White House has not publicly responded.
What Layer3 Found
Layer3 launched a new tool this week called the Residential Proxy Observatory. It tracks services that send traffic through ordinary internet connections. While browsing the data, researchers spotted activity on AS2650. That block of addresses belongs to the Executive Office of the President, which hosts the White House network.
The numbers are specific. From October 5 to November 3, proxy traffic left through the network 236 times. It came from six addresses and appeared on 26 of 30 days. In all, 28 proxy services could send traffic out through the network.
The firm says it never targeted the White House. Instead, it bought rotating proxy access and watched where its own traffic came out. Layer3 says it found the activity by chance.
How a Proxy Works
A proxy rents out a real home or office internet address. A customer sends traffic through it. As a result, websites see the device owner’s address, not the customer’s. Criminals like this because the traffic looks normal. Some businesses use proxies for legal jobs, such as collecting public data from websites.
Often, the device owner has no idea. App makers can add proxy code to free apps and earn a small payment for each install. Then the code quietly turns the user’s device into an exit point for strangers.
Why the Timing Matters
Nearly half of the exits took place between 5 p.m. and midnight in the Eastern time zone. There was no activity at all during the morning hours. According to Layer3, the exit pattern matches a single individual’s device more than a guest Wi-Fi network. It believes that a person uses the network during late night hours on an infected device.
According to KrebsOnSecurity, the security experts had warned about several people using the devices infected by the malware. But the report of Layer3 highlights a pattern indicating a single person.
Other Firms Made the Same Observation
Layer3 checked the addresses against two other tracking firms, Spur and Synthient. Both flag them as proxy exits. Synthient said on X that some of the activity tied to Infatica. That proxy program often ships inside free mobile and desktop apps. Synthient also linked some activity to a streaming app that bundles proxy code.
Infatica drew extra attention because of its founder, Vladimir Fomenko. His hosting company, King Servers, hosted six of eight addresses used in a 2016 break-in. Russian state security used those addresses to hit election databases in Arizona and Illinois, KrebsOnSecurity reported. Still, no report says Infatica targeted the White House. Also, Infatica was not alone. Layer3 counted 28 services.
The Implications
No one has confirmed a breach. Even so, experts see real risk. Layer3 notes that poorly built proxy code has let outsiders reach internal networks and move between devices. Google said in July that an exit device gives outside traffic a path into the home network. Therefore, other devices on the same connection can become exposed.
In January 2026, Synthient founder Ben Brundage showed how criminals abused a flaw in proxy services. They used it to take over devices on local networks. He says some resellers charge as little as 60 cents per gigabyte. For less than a dollar, he says, a buyer can reach trusted networks. Buyers can also skip identity checks.
Blame is another problem. Outside sites see traffic from a White House address, even if a stranger bought it from a proxy service. So someone else’s activity could look like it came from the White House. Similar challenges around anonymity and operational security have also emerged in cryptocurrency investigations, including the White House darknet market closure, which highlighted the limits of crypto privacy and operational security.
Not a One-Off Occurrence for Government Offices
Proxy software shows up on government networks often. In a January 2026 webinar, Spur said it found proxies on nearly 300 government networks. Meanwhile, Infoblox found that 65% of its customers looked up at least one proxy-related domain.
The scale is large, too. In July, Google said it disrupted NetNut, a proxy network built on about 2 million devices. Attackers used it to hide their location and run password-guessing attacks.
Google also said many proxy brands look independent but share the same pool of devices. As a result, one infected device can end up on sale through several sellers.
Next Step
The White House did not immediately respond to a request for comment neither from TorNews or KrebsOnSecurity. Meanwhile, Layer3 says it kept its raw logs. It will share them with any agency that asks. Until the White House answers, key questions remain open. Who owns the device? Is the software still running? Did anyone misuse it?
