Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between October and November 2026, security researchers discovered that multiple residential proxy services—including Infatica, a program linked to Russian hosting operator Vladimir Fomenko whose infrastructure was used in 2016 U.S. election cyberattacks—were actively beaconing from the Executive Office of the President's network (AS2650). Layer3 Intel identified six IP addresses across 26 of 30 days, with 28 separate proxy services able to exit through the White House network, meaning anyone paying as little as 60 cents per gigabyte could route traffic through one of the most sensitive government networks in the world. The root cause was SDK-embedded proxy software silently installed via free consumer applications on staff devices.

This incident underscores how supply-chain SDK compromise and insider-risk through consumer app usage can silently weaponize trusted government or enterprise networks as anonymous proxy infrastructure. As residential proxy networks proliferate—found in nearly 300 government networks and 65% of enterprise DNS environments—the risk of nation-state actors exploiting these footholds for reconnaissance, data exfiltration, or lateral movement has reached a critical threshold demanding immediate egress visibility and policy enforcement.

Why This Matters Now

Residential proxy SDKs are now embedded in mainstream consumer apps downloaded daily onto corporate and government devices. With 28 proxy services simultaneously accessing the White House network and similar nodes found across hundreds of utilities, hospitals, and financial firms, attackers and intelligence services can trivially rent trusted network egress points—bypassing perimeter controls, anonymizing malicious traffic, and exfiltrating data without triggering traditional alerts. The urgency is compounded by known vulnerabilities in these proxy services that enable local network reconnaissance and device compromise.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Staff installed free consumer applications—mobile or desktop—that silently embedded SDK code from residential proxy providers like Infatica, effectively enrolling their devices as proxy exit nodes without the user's awareness.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant here because the attack relied on an SDK-embedded proxy silently enrolling government endpoints as rentable exit nodes, enabling external actors to tunnel traffic through trusted AS2650 address space. By enforcing identity-aware segmentation, controlled egress, and east-west policy at the network fabric level, CNSF would likely reduce the reachability and lateral scope available to actors operating through those compromised proxy nodes.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The reach available to the embedded SDK's outbound beaconing would likely be constrained by fabric-level policy that restricts unapproved application traffic flows from managed endpoints, reducing the proxy enrollment pathway's ability to establish persistent connectivity to external proxy infrastructure.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely constrain the network-level privilege scope available to any process running within the compromised user session, reducing what internal resources that session could reach even if the endpoint itself remained enrolled as a proxy node.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the reachability available to actors traversing through the proxy node, constraining their ability to move laterally toward internal workloads, services, or segments not explicitly permitted in policy for that endpoint's identity and position.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control would likely surface the anomalous outbound connection patterns associated with proxy beaconing — including off-hours volume spikes and connections to known commercial proxy network infrastructure — reducing the ability of the C2 channel to persist undetected within normal egress traffic.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement would likely constrain the volume and destinations of outbound data movement available through the proxy tunnel, reducing the practical throughput and destination flexibility that adversaries depend on for bulk exfiltration through a rentable exit node.

Impact (Mitigations)

Even if endpoint-level SDK enrollment had already occurred, the scope of residual damage would likely be reduced — external actors tunneling through the enrolled nodes would encounter constrained lateral reach, restricted egress paths, and limited access to sensitive internal workloads, narrowing the realistic surface area available for intelligence collection or follow-on staging.

Impact at a Glance

Affected Business Functions

  • Executive Office Network Integrity and Confidentiality
  • Classified and Sensitive Government Communications
  • National Security Intelligence Operations
  • Federal IT Asset and Endpoint Governance
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

The unauthorized presence of residential proxy exit nodes on the Executive Office of the President network (AS2650) means that adversaries or anonymous third parties paying as little as $0.60 per gigabyte could route traffic through White House IP addresses for 236 confirmed sessions over approximately 30 days. This creates risk of: (1) exfiltration of metadata, DNS queries, and traffic patterns from high-sensitivity government endpoints; (2) exposure of internal network topology to any subscriber of 28 identified proxy reseller services; (3) potential for adversarial actors, including Russian-affiliated infrastructure given Infatica founder Vladimir Fomenko's historical ties to King Servers used in 2016 US election cyberattacks, to conduct reconnaissance or inject traffic appearing to originate from White House IP space; (4) compromise of staff device integrity if the same SDK-embedded proxy software contains additional malicious payloads. No confirmed exfiltration of classified documents or PII has been reported at time of publication, but the structural access risk is severe given the sensitivity of the affected network.

Recommended Actions

  • • Deploy Egress Security & Policy Enforcement (CNSF) with FQDN-based filtering and allowlist-only outbound policies to block beaconing connections from proxy SDKs to Infatica and affiliated residential proxy infrastructure — preventing the C2 channel from establishing and cutting off the proxy exit node before it becomes operational.
  • • Implement Multicloud Visibility & Control with continuous traffic baselining and anomaly detection across all AS2650 egress flows to identify persistent low-volume beaconing patterns (e.g., nightly 5 p.m.–midnight proxy traffic) that deviate from expected staff usage profiles, enabling rapid detection of SDK-embedded proxy activity.
  • • Enforce Zero Trust Segmentation with identity-based microsegmentation policies that restrict staff endpoint network access strictly to required internal resources, preventing compromised proxy nodes from being used as lateral movement pivot points into internal services or adjacent network segments.
  • • Apply Cloud Firewall (ACF) internet egress controls with AI-assisted traffic discovery to automatically surface and categorize outbound connections to known residential proxy provider domains and IP ranges, generating alerts and blocking unauthorized proxy relay traffic before external actors can purchase and exploit White House exit nodes.
  • • Establish and enforce a mobile device and application allowlist policy backed by CNSF inline enforcement to prevent installation of free consumer applications containing embedded proxy SDKs on government-issued or BYOD devices used within sensitive network environments, addressing the supply-chain SDK compromise vector at the point of initial infection.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image