[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3eVZy7dKq-WUNuIzC5qIKOqLh1AEk7Z7qyoDfFZpMf8":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5a450de0-f0dc-4584-9b5e-42913147fd43","Residential proxy traffic caught leaving the White House network","residential-proxy-traffic-caught-leaving-the-white-house-network-685bd2","The White House network has been working as an exit point for residential proxy services, a setup that may open a path into one of the most closely guarded networks in the world, Layer3 Intel found. In a blog post, the threat intelligence firm reported that its proxy enumeration pipeline exited through AS2650, the network registered to the Executive Office of the President, 236 times between October 5 and November 3. The exits came from … More → The post Residential proxy traffic caught leaving the White House network appeared first on Help Net Security.","Residential proxy traffic has been observed exiting the White House network, potentially exposing sensitive systems. Threat intelligence firm Layer3 Intel detected this activity, which appeared to originate from compromised devices within the network, possibly due to infected streaming apps like Rave.io containing proxy SDKs.","White House network traffic exiting via residential proxy services detected.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F06\u002Fwhite-house-residential-proxy-traffic\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2023\u002F07\u002F24144037\u002Fwhitehouse-design.jpg","2026-11-06T10:29:58+00:00","2026-11-06T11:00:02.784216+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Windows 11","product",{"name":21,"type":19},"Windows 10",{"name":23,"type":19},"Rave.io",{"name":25,"type":19},"InfaticaSDK",{"name":27,"type":28},"Layer3 Intel","vendor",{"name":30,"type":28},"Synthient","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[],[27,30,18],{"controls":57,"vendors":136},[58,86,107],{"slug":59,"name":60,"problem":61,"products":62},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":81,"url":84,"description":85},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[91,99],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":108,"name":109,"problem":110,"products":111},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"residential-proxy-sdk-hidden-in-streaming-apps-exfiltrates-traffic-from-white-house-network","Residential Proxy SDK Hidden in Streaming Apps Exfiltrates Traffic from White House Network","Compromised consumer-grade streaming applications containing embedded proxy SDKs were able to route network traffic out of what should be one of the most secured government networks in the world. This highlights a critical supply chain risk: software that appears legitimate can silently bundle malicious or privacy-invasive components that repurpose end-user devices as proxy nodes. The fact that this traffic was detected by an external threat intelligence firm — not internal monitoring — underscores a serious gap in egress traffic visibility and endpoint control. Allowing unapproved or unvetted consumer applications on sensitive government networks dramatically expands the attack surface in ways that are difficult to detect without robust outbound traffic analysis.",[142,143,144,145,146,147,148],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1090: Proxy","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":150,"MITRE ATT&CK T1090: Proxy":151,"NIST SP 800-53 SI-2: Flaw Remediation":152,"CIS Control 13: Network Monitoring and Defense":153,"CIS Control 2: Inventory and Control of Software Assets":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 requires incident handling and supply chain security measures for essential entities, directly applicable here where a third-party app component created an undetected exfiltration channel on a critical government network.","This technique specifically covers adversaries using compromised systems as proxies to route traffic, which is precisely how the embedded SDK was exploiting White House network devices as residential proxy exit nodes.","Flaw remediation controls require organizations to identify and correct unauthorized or malicious software components, which would apply to detecting and removing SDK-laden applications before they exfiltrate traffic.","Continuous monitoring of outbound network traffic, including egress filtering and anomaly detection, would have identified the residential proxy traffic internally rather than relying on an external firm.","Maintaining an authoritative inventory of approved software would have prevented unapproved streaming apps containing proxy SDKs from ever running on government network devices.","Systematic vulnerability and configuration management of endpoints, including controlling what third-party software components are permitted, would have surfaced the rogue SDK before it could be exploited.","Restricting which applications and processes are permitted to initiate outbound network connections would have blocked the proxy SDK from routing traffic outside the network."]