Developing Cybersecurity

White House network found to leak proxy access

Layer3 Intel said six White House network addresses were used as exits for 28 residential proxy services 236 times between October 5 and November 3. The reports do not say whether the suggested device has been identified.

Image from Illustration: White House network used as exit for residential proxy trafficIllustration

The story so far

Layer3 Intel reported that residential proxy nodes were beaconing from the White House network, allowing 28 services to rent the addresses. It linked the activity to a Russian-founded proxy program and said it persisted for months. A later report said six White House addresses were used as exits for 28 proxy services 236 times between October 5 and November 3. The traffic was mostly between 5 p.m. and midnight Eastern time, suggesting a device was running proxy software. Synthient detected Windows 10 and Windows 11 devices beaconing to proxy providers.

Latest updates

2 updates · newest first
  1. 6 Nov
    New development

    White House network used as exit for residential proxy traffic

    Layer3 Intel said six addresses on the White House network were used as exits for 28 residential proxy services 236 times between October 5 and November 3. The traffic, mostly between 5 p.m. and midnight Eastern time, suggests a device on the network was running proxy software. Synthient said it detected Windows 10 and Windows 11 devices beaconing to known proxy providers.

    Help Net Security ↗SecurityWeek ↗CSO Online ↗
  2. 5 Nov
    New development

    White House network found to leak proxy access to 28 services

    Security firm Layer3 Intel detected residential proxy nodes beaconing from the White House network, allowing 28 separate services to rent the addresses. The activity, linked to a Russian-founded proxy program, persisted for months and exposed the Executive Office to potential traffic anonymization.

    Krebs on Security ↗

Key facts

Layer3 Intel detected residential proxy nodes beaconing from the White House network.Reported by Krebs on Security
The proxy activity allowed 28 separate services to rent the addresses.Reported by Krebs on Security
The activity was linked to a Russian-founded proxy program and persisted for months.Reported by Krebs on Security
Six White House network addresses were used as exits for 28 residential proxy services 236 times.Reported by Help Net Security, SecurityWeek and CSO Online
The exits were used between October 5 and November 3, mostly between 5 p.m. and midnight Eastern time.Reported by Help Net Security, SecurityWeek and CSO Online
Synthient detected Windows 10 and Windows 11 devices beaconing to known proxy providers.Reported by Help Net Security, SecurityWeek and CSO Online

What’s still unknown

Whether the suggested device has been identified
How the proxy software reached the White House network
What impact the proxy traffic had on the Executive Office

All sources

4 articles

In the daily editions

Related developing stories

Follow this story by email

Get one email when there’s a new update, no more than one a day.