[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2_cExLMX-1abrr7BR5TQa__VrBhnD4SICDFAGNORoEs":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a6832e12-e764-4ee4-84a1-60409eb439c8","Researchers Find Residential Proxies on White House Network","researchers-find-residential-proxies-on-white-house-network-711720","In a month, 28 residential proxy services used 6 addresses, mainly between 5 p.m. and midnight, Eastern Time. The post Researchers Find Residential Proxies on White House Network appeared first on SecurityWeek.","Researchers discovered that 28 residential proxy services utilized six IP addresses on the White House network, the Executive Office of the President, for malicious traffic. This activity, observed primarily in the evenings, suggests a compromised device within the network running Infatica's SDK on Windows 11 machines. The Infatica service has historical ties to a provider that hosted infrastructure used by Russian hackers in the 2016 US election attacks.","Residential proxy services exploited White House network IPs for malicious traffic.","https:\u002F\u002Fwww.securityweek.com\u002Fresearchers-find-residential-proxies-on-white-house-network\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F01\u002FWhitehouse-Cybersecurity.jpg","2026-11-06T12:16:13+00:00","2026-11-06T13:00:26.859677+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"InfaticaSDK","product",{"name":21,"type":22},"Infatica","vendor",{"name":24,"type":19},"Windows 11",{"name":26,"type":22},"King Servers",{"name":28,"type":29},"Russian state-sponsored hackers","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},[],[21,26,18],{"controls":51,"vendors":131},[52,73,102],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[57,65],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":74,"name":75,"problem":76,"products":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":103,"name":104,"problem":105,"products":106},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":144},"residential-proxy-sdk-found-running-on-white-house-network-devices","Residential Proxy SDK Found Running on White House Network Devices","Researchers discovered that compromised devices on the Executive Office of the President network were being used as residential proxy exit nodes, routing potentially malicious third-party traffic through one of the most sensitive government networks in the world. The likely culprit is a third-party SDK — Infatica — bundled into software installed on Windows 11 machines, illustrating how supply chain components can silently introduce unauthorized functionality. The activity occurring primarily in the evenings suggests the compromise went undetected during normal monitoring windows, pointing to gaps in continuous network traffic analysis. This matters enormously because residential proxies on government infrastructure can be exploited to launder malicious traffic, bypass IP-based security controls, and obscure the true origin of cyberattacks — with Infatica's historical ties to Russian election interference infrastructure raising the stakes further.",[137,138,139,140,141,142,143],"CIS Control 7: Continuous Vulnerability Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":145,"MITRE ATT&CK T1566: Phishing":146,"NIST SP 800-53 SI-2: Flaw Remediation":147,"CIS Control 17: Incident Response Management":148,"CIS Control 7: Continuous Vulnerability Management":149,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":150,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":151},"NIS2 requires essential-entity operators to implement incident handling and supply chain security measures; the undetected presence of a third-party proxy SDK on critical government infrastructure is precisely the supply chain risk NIS2 is designed to mandate controls against.","While the precise infection vector is unconfirmed, proxy SDKs are frequently delivered via trojanized or socially engineered software installs, making phishing-awareness and endpoint controls directly relevant to preventing the initial compromise.","NIST SI-2 requires organizations to identify and remediate unauthorized or malicious software components; a formal process here would have caught the proxy SDK embedded in endpoint software.","The apparent lack of timely detection and response to anomalous evening-hours proxy traffic highlights the need for a mature incident response capability that acts on behavioral anomalies around the clock.","Regular scanning of installed software and network traffic would have flagged the unauthorized Infatica SDK and its outbound proxy connections before the activity persisted undetected.","ISO 27001 A.8.8 mandates continuous management of technical vulnerabilities including unauthorized or risky third-party components, which an active SDK audit program would have addressed on this network.","Controlling which software and network services are authorized to run and communicate outbound on sensitive government networks is a core access control principle that would have prevented the proxy service from operating undetected."]