[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbTc03s3gPJTZHePljdv8DXkwsctvn5iv7cT5M85DNPM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"58b2727b-87c3-4ec1-8968-32450066607f","residential-proxy-nodes-found-operating-inside-white-house-network","94ed70df-d974-4540-8cc2-fe514e6d57f4","Residential Proxy Nodes Found Operating Inside White House Network","Residential proxy software — typically bundled silently into free applications — was discovered operating on the Executive Office of the President's network, effectively renting out government IP addresses to unknown third parties. The root cause is a failure of software inventory and configuration governance: unauthorized or unvetted applications were allowed to install and run on a highly sensitive network. This matters enormously because adversaries can abuse these proxy nodes to launder malicious traffic, conduct reconnaissance, or pivot deeper into government infrastructure while appearing to originate from a trusted U.S. government address. The involvement of a service linked to a Russian-founded company with ties to election system cyberattacks elevates the national security implications significantly.","**Immediate actions:**\n- Audit all endpoints on sensitive government networks for unauthorized or bundled proxy software and remove any identified residential proxy agents immediately.\n- Block outbound connections to known residential proxy service infrastructure (e.g., Infatica endpoints) at the perimeter firewall and DNS layer.\n\n**Supply chain & software governance:**\n- Enforce a strict application allowlist policy so that only explicitly approved, vetted software can execute on government network endpoints.\n- Require a formal vetting process — including country-of-origin and ownership review — for all third-party software and free tools before they are permitted on any classified or sensitive network.\n- Mandate software bills of materials (SBOMs) for all applications deployed in sensitive environments to identify hidden or bundled components.\n\n**Detection measures:**\n- Deploy continuous network traffic monitoring to flag unusual outbound data flows, peer-to-peer connection patterns, or traffic routed through residential proxy networks.\n- Implement endpoint detection and response (EDR) tools configured to alert on processes that establish persistent outbound tunnels or proxy-like behavior.",[12,13,14,15,16,17,18],"CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy","NIS2 Article 21(2)(b)","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1090: Proxy":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 13: Network Monitoring and Defense":23,"CIS Control 2: Inventory and Control of Software Assets":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires incident handling and supply chain security measures; the presence of software tied to a foreign-linked company on critical government infrastructure highlights the need for mandatory supply chain risk assessments of all deployed software.","This technique — using a compromised or enrolled host as a proxy node — is precisely what the residential proxy services exploit, and defenders monitoring for anomalous proxy-like outbound traffic patterns would have detected it earlier.","Systematic scanning and remediation processes would have identified the unauthorized software component and triggered removal, limiting the exposure of the government network.","Continuous monitoring of outbound network traffic for peer-to-peer or proxy relay patterns would have detected the residential proxy nodes relaying traffic out of the White House network in near-real time.","Maintaining an authoritative inventory of authorized software would have flagged the unauthorized residential proxy agent running on government endpoints before it could be exploited.","A formal process for identifying and managing vulnerable or unauthorized software components would have surfaced the proxy agent and triggered an incident response before sensitive IP addresses were rented out.","Strict controls over what software and services are permitted to authenticate and communicate outbound from sensitive networks would have prevented the proxy service from establishing connections to external infrastructure.","published","2026-11-05T05:20:26.691922+00:00","2026-11-05T05:20:26.679+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F11\u002Fwant-to-rent-an-internet-address-at-the-white-house\u002F","want-to-rent-an-internet-address-at-the-white-house-a268ea","Want to Rent an Internet Address at the White House?",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":54,"name":55,"problem":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":58,"name":59,"problem":60},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]