White House Network Possibly Exposed to Hackers Via Proxy Services

White House staffers might be using a Windows app that can also secretly give cybercriminals a way to route traffic through West Wing internet addresses.

Two cybersecurity providers have uncovered evidence that numerous residential proxy services have access to the White House’s network. That’s concerning because proxy services sell access to IP addresses in different parts of the world.

It's also alarming because cybercriminals regularly use proxy services to stage and hide their hacking activities by exploiting IP addresses that may be associated with a legitimate user’s residence, office, or even a government agency. In addition, consumer devices, including smart TVs and routers , can be secretly ensnared by such proxy services via malware or shady third-party software development kits (SDKs).

The evidence initially came from the cybersecurity vendor Layer 3 Intel, which was examining the network block AS2650 , dedicated to the White House. Layer 3 Intel discovered internet traffic exiting the AS2650 network from at least 28 known residential proxy services between Oct. 5 and Nov. 3.

“Most of the activity happens in the evening, Eastern time: half of it falls between 5 p.m. and midnight, and almost none happens in the early morning,” Layer 3 Intel wrote in its report. “That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy.”

Synthient, another company that tracks residential proxies, has also uncovered evidence linking the suspicious White House proxy traffic to Rave.io, a service that lets you watch streaming services together with friends. Rave.io supports macOS, Windows, Android, and iOS. But according to Synthient, the Rave app appears to also be installed with 12 proxy-related SDKs.

“Synthient has the ability to detect the device on a per-session basis, which reveals a number of Windows 10 and Windows 11 devices beaconing to known proxy providers like Geonode, Infatica, and Mellowtel,” the company said .

The Infatica mention is notable because the proxy service comes from a Russian man named Vladimir Fomenko, who ran a hosting service that Russia’s state security services used to compromise election database systems in Arizona and Illinois in 2016, according to cybersecurity journalist Brian Krebs. Infatica's marketing touts access to over 40 million IP addresses.

Synthient adds: “Some of the proxy resellers are observed selling bandwidth for as low as 30 cents per GB or $4 per hour. With zero KYC (Know Your Customer)."

Rave and the White House didn’t immediately respond to a request for .