Cybersecurity researchers recently discovered that internet traffic from the White House was being routed through residential proxy services. The breach appears linked to the Raveio streaming app installed on devices within the Executive Office of the President, allowing third parties to utilize the secure network's IP addresses.
236 network exits from the White House between October and November
Between October 5 and November 3,researchers at Layer3 detected internet traffic exiting the White House network on AS2650 exactly 236 times.. According to Layer3, this activity spanned 26 of those 30 days and utilized six different IP addresses. The traffic was found across 28 separate residential proxy services, which are platforms that sell access to the internet addresses of ordinary users to make traffic appear as if it is coming from a home or office.
The financial barrier to entering such a high-security environment is alarmingly low.. As reported by Layer3, some resellers sell this bandwidth for as little as 60 cents per Gigabyte. This enables almost any actor to mask their digital footprint behind a trusted government IP address for less than a dollar.
How the Raveio app and three SDKs breached the Executive Office
The vulnerability stems from the use of free applications that monetize user bandwidth via Software Development Kits (SDKs). Layer3 and Synthient identified the culprit as Raveio, a shared streaming platform. This specific application bundles 12 proxy SDKs into its ecosystem, including those from Geonode, Infatica, and Mellowtel.
Synthient identified that Windows 10 and Windows 11 devices were communicating with these proxy networks. By searching VirusTotal for Windows applications containing all three of those specific SDKs, researchers found that only Raveio matched the criteria. This suggests that employees brought personal devices running the Raveio app into the workplace, inadvertently creating a pathway for unauthorized traffic to leave the secure environment.
The 5 p.m. to midnight window suggests personal device usage
The timing of the network exits provides a clue about the nature of the breach.. Layer3 observed that roughly half of the traffic occurred between 5 p.m. and midnight Eastern time, with almost no activity in the early morning hours. This pattern strongly suggests that an individual was using a personal device on the network during evening hours rather than a dedicated government workstation.
While the researchers could identify the exit points, they could not pinpoint the specific device or the individual responsible. However, the consistency of the evening traffic indicates a regular habit of a single user on the Executive Office of the President's network.
From North Korean laptop farms to the 1.3 million XCPE botnet
This incident is part of a wider trend where residential proxies are weaponized by both criminals and nation-states. Google's Threat Intelligence Group recently dismantled the XCPE backdoor, which had enrolled over 1.3 million set-top boxes into a botnet to rent out residential proxy networks for financial gain. Similarly, attackers have exploited vulnerabilities in Plex Media Server to install cryptoccurrency miners and proxy software.
State-sponsored actors have also adopted these tactics. As reported by Krebs on Security, North Korea has routed traffic through American home networks to hide its cyber operations. This strategy has even involved "laptop farms" and human proxies, a scheme that recently triggered FBI raids on more than 40 homes in Texas.
Which specific White House systems were exposed to local network probing?
The most pressing remaining question is whether this proxy access allowed for deeper penetration into the White House network. Researchers noted that in late 2025, criminals exploited flaws in proxy services to probe local networks for other systems to infect. If the Raveio SDK contained similar flaws, it could have potentially allowed a third party to reach other systems on the local network, provided those systems were not properly isolated.
It remains unverified whether any malicious actors actually utilized these specific White House IP addresses for attacks or if the traffic was merely the result of commercial bandwidth monetization. The White House has not yet detailed the extent of the internal network segmentation that may have mitigated this risk .
Comments 0