🛰️ The code that turns a device into someone else's internet connection found running on the White House network

05 Nov, 2026

Source: Cybersecuritynews, 2026-11-05. https://cybersecuritynews.com/white-house-network-ip-for-rent/

Researchers at Layer3 Intel found that 28 residential proxy services rent addresses on the White House network. Anyone with a few dollars could send web traffic through them. The activity ran from October 5 to November 3, 2026.

...

A residential proxy sends web traffic through a real home or office connection, so the traffic looks like it comes from an ordinary user. Many device owners never agree to this. Hidden software in an app or a cheap device can sell bandwidth without the owner’s knowledge. Because the addresses look normal, simple blocklists often fail to catch them.

Source: Layer3 Intel: Residential Proxies Detected on White House Network (2026-11-04)

Also:

• Runtime Wire: Residential proxy traffic exited the White House network 236 times in 30 days, researchers say, a careful summary of what was and wasn't measured
• Spur and Synthient IP-context pages for the six addresses, the independent confirmation Layer3 cites

The whole picture, in order

• When you use the internet, every site you visit sees an address that says roughly where you're connecting from. A home connection gets a "home" address. A data center gets a "data center" address.
• Websites trust home addresses more. A thousand requests from a data center looks like a bot. A thousand requests from a thousand homes looks like a thousand people.
• So home addresses are worth money. Scrapers, ad-fraud operators, bots that buy up concert tickets, people getting around a country block: they'll all pay to look like they're coming from somebody's house.
• A proxy is a middleman. You send your traffic to it, it sends it on under its own address, and the site sees the middleman instead of you.
• A residential proxy is a middleman that happens to be somebody's actual home device: a phone, a laptop, a router, a streaming stick. That's the whole term. A proxy that lives in a house.
• The companies selling this don't own the houses. They rent the devices, usually without the owner understanding. Most often the way in is an app the owner installed (free VPNs, "get paid to share your unused internet," cheap streaming boxes, some games) with a small piece of code inside that takes orders from a company you've never heard of. Sometimes it's malware on a router or a stick the owner never touched. Either way, something on the device quietly relays other people's traffic out through your connection.
• The owner doesn't notice. It's quiet, it uses little bandwidth, and nothing on the device looks wrong.
• A botnet is the general word for many devices taking orders from one operator. The classic kind is built by infecting devices and used for attacks. A residential proxy network is a botnet with a business model: the devices join by app instead of by infection, and the capacity is sold instead of used.
• The two blur together when the code is sloppy enough that whoever controls it can reach into the device's local network. That has happened. One such network, Kimwolf, grew to at least two million devices.
• How anyone finds out: from the far end. Layer3 Intel bought a few dollars of access from 28 of these services, sent their own traffic through, and wrote down which home addresses it came out of.
• Six of the addresses it came out of belong to the White House network. 236 times between October 5 and November 3, on 26 of 30 days. About half in the evening, Eastern time, which Layer3 reads as a person's device rather than guest Wi-Fi: someone regularly on the network late, carrying something that's been enrolled.
• So: nobody broke into the White House. A device with this code on it connected to the Wi-Fi, and for a month strangers' traffic has been leaving through a federal address. Whoever operates that code has a line to a device on that network.
• Which device? Only the White House's own network team can answer that, by matching the six addresses to who was connected when. Layer3 says it has kept the raw logs for any agency that asks.

What it does and doesn't mean

It doesn't mean the White House was hacked, and Layer3 doesn't say it was. Their claim is narrow: proxy traffic exiting those addresses, plus an inference that enrollment code is present on a device, with no identification of which device.

What makes it more than embarrassing is the history of the class. This kind of code phones home and does what it's told, and poorly secured versions have been found to let the operator into the device's local network. Synthient documented the Kimwolf botnet reaching at least two million devices, mostly Android with exposed ADB, through residential proxy networks. The honest risk statement isn't "compromised." It's "running something that has been a door before."

Q&A with Claude

my questions, Claude's answers. Critique & refinement welcome.

So what actually happened? Six addresses, 236 exits: is that the finding?

Six addresses on one network is a pointer, not a finding. The finding is "there's a device." What would settle it is which device, and that's only answerable from inside: join the six addresses to DHCP leases, join the evening timestamps to a badge log, and you've got a name and a phone. That's why Layer3 kept the raw logs. From outside, the evening clustering and the single network are consistent with the most ordinary story: a staffer's personal phone, on the Wi-Fi, with a free VPN or a bandwidth-sharing app on it.

Why didn't they catch it themselves?

Because nobody was reading the outbound side. This kind of code isn't an attack coming in; it's a device quietly making connections out, to a service it has no reason to talk to, at hours when nobody's using it. Most monitoring watches the inbound door. Layer3 saw it from the far end: by being one of the strangers whose traffic came out. The same thing would be true of a bank, a hospital, or a manufacturer's office: the device that's renting itself out looks like any other device unless something is counting where connections go.

Is this the same thing as the botnet stories?

Adjacent. A residential proxy network is a kind of botnet with a business model: the devices are usually enrolled by an app rather than by a break-in, and the operator sells the capacity instead of using it. The line between the two blurs when the code is sloppy enough to let the operator (or whoever compromises the operator) reach the device's local network. That's the Kimwolf lesson and it's why "it's just a proxy" undersells it.

What would I do with this at home?

Count outbound connections per device, by hour. That's it. A phone or box that talks to the same unfamiliar service at 11 pm every night, on a network where nobody's awake, is the signature. It's the exact job of a traffic logger sitting between the gateway and the LAN: not blocking anything, just writing down who talked to whom and when, so the pattern has somewhere to show up.

Open questions

• Which device? (Only answerable from inside; watch for an agency statement or a quiet IT notice.)
• Which app? Layer3 names the mechanism, not the SDK. The proxy services are public; the SDK vendors that feed them are the interesting list.
• How many other government ASes show the same pattern in the observatory? The White House was the one they noticed, not necessarily the only one.
• Does a federal BYOD policy address proxy SDKs at all, or only "malware"?

Drafted with Claude Fable 5.1 · 2026-11-04 · sources fetched 2026-11-04 (America/Chicago)