The security firm Layer3 Intel says its residential proxy monitoring routed traffic out through AS2650, the network of the Executive Office of the President, 236 times between October 5 and November 3, from six addresses on 26 of 30 days, via 28 different proxy services. Residential proxy services sell the use of ordinary people's devices so traffic appears to come from their networks, often via SDKs bundled into free apps. Layer3 says anyone could buy this access for a few dollars, that other detection services also list the addresses as proxy exits, and that the evening-heavy timing suggests an infected personal device rather than guest Wi-Fi.

KrebsOnSecurity reports that Synthient linked the activity to Windows 11 installations of Infatica, a proxy service whose founder's hosting firm, King Servers, hosted most of the addresses Russia used against Arizona and Illinois election systems in 2016. Synthient's Ben Brundage says some resellers charge as little as 60 cents a gigabyte. Layer3 says it will share its logs with agencies.