Want to Rent an Internet Address at the White House?
White House staffers' devices are being used for residential proxy services, potentially exposing sensitive networks.
Security experts have detected residential proxy nodes operating from the White House's Executive Office of the President network. These services, often integrated into free applications, allow users to rent out their internet addresses, potentially exposing sensitive networks to malicious actors. One identified service, Infatica, is linked to a Russian company whose founder has past ties to election system cyberattacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Layer3 Intel?
Get an email when a new story names Layer3 Intel, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResidential proxy software — typically bundled silently into free applications — was discovered operating on the Executive Office of the President's network, effectively renting out government IP addresses to unknown third parties. The root cause is a failure of software inventory and configuration governance: unauthorized or unvetted applications were allowed to install and run on a highly sensitive network. This matters enormously because adversaries can abuse these proxy nodes to launder malicious traffic, conduct reconnaissance, or pivot deeper into government infrastructure while appearing to originate from a trusted U.S. government address. The involvement of a service linked to a Russian-founded company with ties to election system cyberattacks elevates the national security implications significantly.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Infatica