[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fICdI8jyZH9u-yjUBKA9D_B5MYrWYFnhs9RPm-uyaLbQ":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"a9c1b520-6ecd-4748-a8e6-b8bc2d72b1bb","White House Network Appears in Global Residential Proxy Traffic","white-house-network-appears-in-global-residential-proxy-traffic-8ca831","Layer3 found residential proxy traffic using the White House network, raising concerns about potential exposure of internal systems. Layer3 Intel says it found residential proxy traffic leaving through the White House network. The researchers spotted it while browsing their new Residential Proxy Observatory, a tool that gives a global view of residential proxy and anonymized […]","Layer3 researchers discovered residential proxy traffic originating from the White House network, raising concerns about potential internal system exposure. The activity, detected over a month, involved 28 different proxy services using the Executive Office of the President's network. While the origin and intent are unknown, the researchers highlight the risk of poorly secured proxy SDKs enabling lateral movement within internal networks, similar to past botnet incidents.","White House network traffic found routed through residential proxy services.","https:\u002F\u002Fsecurityaffairs.com\u002F202563\u002Fsecurity\u002Fwhite-house-network-appears-in-global-residential-proxy-traffic.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Fimage-35-1024x683.png","2026-11-06T22:17:34+00:00","2026-11-06T23:00:35.359718+00:00",7,[17,20],{"name":18,"type":19},"Layer3","vendor",{"name":21,"type":19},"Synthient","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":22,"icon":24,"name":25,"slug":26},null,"Threat Intelligence","threat-intelligence",[28,33,38,43],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":22,"icon":24,"name":25,"slug":26},[],[18,21],{"controls":48,"vendors":127},[49,77,98],{"slug":50,"name":51,"problem":52,"products":53},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[54,62,69],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":64,"url":67,"description":68},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":78,"name":79,"problem":80,"products":81},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[82,90],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":99,"name":100,"problem":101,"products":102},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"white-house-network-found-routing-residential-proxy-traffic","White House Network Found Routing Residential Proxy Traffic","Researchers detected traffic from the Executive Office of the President's network appearing within global residential proxy services over a sustained month-long period, involving 28 separate proxy providers. This suggests that poorly secured or silently bundled proxy SDKs may have compromised internal systems, turning them into unwitting nodes in a commercial or malicious proxy network. The incident mirrors historical botnet cases where legitimate endpoints are silently recruited without user or administrator awareness. This matters enormously because a government network being enrolled in proxy infrastructure could expose internal topology, facilitate lateral movement, and obscure the true origin of sensitive communications. Without robust egress monitoring and software inventory controls, such activity can persist undetected for extended periods.",[133,134,135,136,137,138,139],"CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":141,"MITRE ATT&CK T1090: Proxy":142,"NIST SP 800-53 SI-2: Flaw Remediation":143,"CIS Control 13: Network Monitoring and Defense":144,"CIS Control 7: Continuous Vulnerability Management":145,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":146,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":147},"NIS2 requires incident handling and monitoring controls sufficient to detect anomalous network behavior; the month-long undetected proxy activity demonstrates a gap in the continuous monitoring obligations this article mandates for critical entities.","This technique directly describes adversaries using proxies to route traffic and obscure origin, which is precisely the behavior observed when government systems were enrolled in residential proxy services.","Identifying and remediating insecure or unapproved software components, including proxy SDKs, is a core flaw remediation function that would have prevented unauthorized proxy enrollment.","Continuous monitoring of network traffic, particularly outbound egress flows, would have detected the anomalous connections to 28 residential proxy services far earlier than external researchers did.","Regular scanning of internal endpoints would have flagged the presence of unauthorized or vulnerable proxy SDKs before they could enroll government systems into external proxy networks.","A formal process for identifying and managing technical vulnerabilities, including unauthorized third-party components, would have surfaced the proxy SDK risk before external exposure occurred.","Controlling which software and network communications are authorized on government systems would have restricted proxy SDKs from establishing outbound connections without explicit approval."]