Residential Proxy SDK Found Running on White House Network Devices
Researchers discovered that compromised devices on the Executive Office of the President network were being used as residential proxy exit nodes, routing potentially malicious third-party traffic through one of the most sensitive government networks in the world. The likely culprit is a third-party SDK — Infatica — bundled into software installed on Windows 11 machines, illustrating how supply chain components can silently introduce unauthorized functionality. The activity occurring primarily in the evenings suggests the compromise went undetected during normal monitoring windows, pointing to gaps in continuous network traffic analysis. This matters enormously because residential proxies on government infrastructure can be exploited to launder malicious traffic, bypass IP-based security controls, and obscure the true origin of cyberattacks — with Infatica's historical ties to Russian election interference infrastructure raising the stakes further.
Tactical Insight
Immediate actions
- Audit all software installed on government endpoints for bundled third-party SDKs or proxy-related components and remove unauthorized tools immediately.
- Block outbound connections from executive network hosts to known residential proxy infrastructure using firewall deny-lists and threat intelligence feeds.
- Isolate any devices identified as active proxy nodes from the broader network pending full forensic investigation.
Long-term improvements
- Establish a rigorous software supply chain vetting process that reviews all SDKs, libraries, and bundled components before deployment on sensitive networks.
- Enforce application allowlisting on all endpoints to prevent unauthorized software — including SDKs — from executing without explicit approval.
- Implement network segmentation so that workstations on sensitive networks cannot initiate arbitrary outbound internet connections without passing through inspected, authenticated proxies.
Detection measures
- Deploy 24/7 network traffic analysis with behavioral anomaly detection, specifically tuned to flag unusual outbound connection patterns during off-hours.
- Integrate threat intelligence feeds that flag known residential proxy provider IP ranges and domains, triggering automated alerts on any matching traffic.