[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3c-vqjnTe4vNp5WidEThAfqsu1m5wCELWbYlBNGxFG4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"a7ea82e8-ce51-49f2-8108-431480b95389","residential-proxy-sdk-found-running-on-white-house-network-devices","a6832e12-e764-4ee4-84a1-60409eb439c8","Residential Proxy SDK Found Running on White House Network Devices","Researchers discovered that compromised devices on the Executive Office of the President network were being used as residential proxy exit nodes, routing potentially malicious third-party traffic through one of the most sensitive government networks in the world. The likely culprit is a third-party SDK — Infatica — bundled into software installed on Windows 11 machines, illustrating how supply chain components can silently introduce unauthorized functionality. The activity occurring primarily in the evenings suggests the compromise went undetected during normal monitoring windows, pointing to gaps in continuous network traffic analysis. This matters enormously because residential proxies on government infrastructure can be exploited to launder malicious traffic, bypass IP-based security controls, and obscure the true origin of cyberattacks — with Infatica's historical ties to Russian election interference infrastructure raising the stakes further.","**Immediate actions:**\n- Audit all software installed on government endpoints for bundled third-party SDKs or proxy-related components and remove unauthorized tools immediately.\n- Block outbound connections from executive network hosts to known residential proxy infrastructure using firewall deny-lists and threat intelligence feeds.\n- Isolate any devices identified as active proxy nodes from the broader network pending full forensic investigation.\n\n**Long-term improvements:**\n- Establish a rigorous software supply chain vetting process that reviews all SDKs, libraries, and bundled components before deployment on sensitive networks.\n- Enforce application allowlisting on all endpoints to prevent unauthorized software — including SDKs — from executing without explicit approval.\n- Implement network segmentation so that workstations on sensitive networks cannot initiate arbitrary outbound internet connections without passing through inspected, authenticated proxies.\n\n**Detection measures:**\n- Deploy 24\u002F7 network traffic analysis with behavioral anomaly detection, specifically tuned to flag unusual outbound connection patterns during off-hours.\n- Integrate threat intelligence feeds that flag known residential proxy provider IP ranges and domains, triggering automated alerts on any matching traffic.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential-entity operators to implement incident handling and supply chain security measures; the undetected presence of a third-party proxy SDK on critical government infrastructure is precisely the supply chain risk NIS2 is designed to mandate controls against.","While the precise infection vector is unconfirmed, proxy SDKs are frequently delivered via trojanized or socially engineered software installs, making phishing-awareness and endpoint controls directly relevant to preventing the initial compromise.","NIST SI-2 requires organizations to identify and remediate unauthorized or malicious software components; a formal process here would have caught the proxy SDK embedded in endpoint software.","The apparent lack of timely detection and response to anomalous evening-hours proxy traffic highlights the need for a mature incident response capability that acts on behavioral anomalies around the clock.","Regular scanning of installed software and network traffic would have flagged the unauthorized Infatica SDK and its outbound proxy connections before the activity persisted undetected.","ISO 27001 A.8.8 mandates continuous management of technical vulnerabilities including unauthorized or risky third-party components, which an active SDK audit program would have addressed on this network.","Controlling which software and network services are authorized to run and communicate outbound on sensitive government networks is a core access control principle that would have prevented the proxy service from operating undetected.","published","2026-11-06T13:21:47.456864+00:00","2026-11-06T13:21:47.421+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Fresearchers-find-residential-proxies-on-white-house-network\u002F","researchers-find-residential-proxies-on-white-house-network-711720","Researchers Find Residential Proxies on White House Network",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":64,"name":65,"problem":66},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]