VULNpocalypse
MediumBreach / campaignMonitoring

Residential proxy traffic seen exiting the White House (EOP) network AS2650, a threat-intel vendor reports

Layer3 Intel reports 236 residential proxy exits over 30 days on AS2650, registered to the Executive Office of the President; the cause is unconfirmed.

Published
Updated
Exploitation
Not confirmed. A vendor observed residential proxy exit traffic attributed to AS2650 by registration only; it is not a confirmed intrusion and there is no official response

What happened

On 4 November 2026 the threat-intelligence vendor Layer3 Intel reported that its Residential Proxy Observatory had seen residential proxy “exit” traffic leaving AS2650, an autonomous system registered to the Executive Office of the President (EOP), the agency that runs the White House network (Layer3 Intel). That AS2650 belongs to the Executive Office of the President is independently visible in public routing records (Hurricane Electric BGP).

What Layer3 says it saw, 5 October to 3 November 2026 (Layer3 Intel):

  • 236 separate residential proxy exits through the network.
  • 6 distinct IP addresses, on 26 of 30 days.
  • 28 separate residential proxy services able to exit through the network.

Layer3 says it did not target the network and found the activity by chance while buying ordinary “global rotating” residential proxy access, which anyone can rent for a few dollars. It says it confirmed the addresses against two other detection services, Spur and Synthient, whose public IP pages also label them as residential proxy exits (Layer3 Intel).

What this does not establish. By Layer3’s own account the data shows exits, “not the device or the person behind them,” and the tie to the EOP rests on the registration of the AS2650 address space, not on any identified device. Layer3’s suggestion that an infected personal device is behind the evening-heavy pattern is an inference, not a finding; it did not publish the six IP addresses; and Layer3 sells the observatory the post promotes, so it has a commercial interest. There is no official White House or EOP response, and no other primary source has confirmed the finding (Layer3 Intel).

Why proxyware matters anyway. Residential proxy services pay people, or silently hijack devices, to run a small SDK that resells the device’s internet connection to anonymous buyers. Layer3 cites research that a poorly secured proxy SDK can expose internal network access and enable lateral movement, which could let a buyer of proxy access reach internal systems; the same research describes the Kimwolf botnet reaching at least 2 million devices, mostly Android devices with an exposed ADB service (Synthient). Whether or not the EOP attribution holds, that exposure applies to any organisation whose managed devices run proxyware.

Am I affected?

  • Any organisation can be, independent of this specific report: a laptop, phone or server on your network that runs a residential proxy SDK becomes a rentable exit node, and buyers of that proxy access may be able to reach whatever that device can.
  • Bring-your-own and personal devices are the usual carrier, through bundled “free VPN” or reward apps that embed a proxy SDK, or through malware.
  • This report specifically concerns AS2650 only; no other network is named, and the cause for AS2650 is not confirmed.

What to do now

  1. Hunt for proxyware on managed devices. Look for known residential proxy and proxyware SDKs and processes on endpoints and servers through your EDR, and flag unexpected proxy or VPN-reward software.
  2. Monitor egress to residential-proxy networks. Alert on outbound connections your devices make to known residential proxy infrastructure, and check your own public IPs against services such as Spur and Synthient to see whether they are listed as proxy exits (Layer3 Intel).
  3. Default-deny egress from servers and sensitive segments through allow-listed proxies, so an SDK cannot freely open outbound tunnels.
  4. Separate personal and bring-your-own devices from networks that can reach internal or sensitive systems.
  5. Block or govern reward and free-VPN apps that bundle proxy SDKs on managed devices through application control.
  6. Secure mobile debugging surfaces, since the cited botnet spread mostly through Android devices with an exposed ADB service: ensure ADB over the network is disabled on fleet devices (Synthient).

Sources