[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEjHFRDfWtLIy_BS2j04BJyQsem-_RVZNF98UCnAQ1h0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"36667a5e-4c3d-4b33-aa01-7115c27a515a","white-house-network-found-routing-residential-proxy-traffic","a9c1b520-6ecd-4748-a8e6-b8bc2d72b1bb","White House Network Found Routing Residential Proxy Traffic","Researchers detected traffic from the Executive Office of the President's network appearing within global residential proxy services over a sustained month-long period, involving 28 separate proxy providers. This suggests that poorly secured or silently bundled proxy SDKs may have compromised internal systems, turning them into unwitting nodes in a commercial or malicious proxy network. The incident mirrors historical botnet cases where legitimate endpoints are silently recruited without user or administrator awareness. This matters enormously because a government network being enrolled in proxy infrastructure could expose internal topology, facilitate lateral movement, and obscure the true origin of sensitive communications. Without robust egress monitoring and software inventory controls, such activity can persist undetected for extended periods.","**Immediate actions:**\n- Conduct an emergency audit of all outbound traffic from government network endpoints to identify unauthorized proxy service connections.\n- Block known residential proxy service endpoints and SDK call-home domains at the perimeter firewall and DNS layer.\n\n**Long-term improvements:**\n- Establish and enforce a strict software allowlist policy to prevent unauthorized SDKs or third-party libraries from being installed on government systems.\n- Implement network segmentation to isolate sensitive internal systems from general-purpose endpoints that may interact with untrusted external software.\n- Create and maintain a comprehensive software bill of materials (SBOM) for all applications deployed across government networks to detect bundled proxy SDKs.\n\n**Detection measures:**\n- Deploy egress traffic analysis tools capable of identifying anomalous outbound connection patterns consistent with proxy enrollment or botnet behavior.\n- Configure SIEM alerts for sustained, high-frequency outbound connections to multiple commercial proxy service IP ranges originating from internal hosts.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1090: Proxy":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 13: Network Monitoring and Defense":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires incident handling and monitoring controls sufficient to detect anomalous network behavior; the month-long undetected proxy activity demonstrates a gap in the continuous monitoring obligations this article mandates for critical entities.","This technique directly describes adversaries using proxies to route traffic and obscure origin, which is precisely the behavior observed when government systems were enrolled in residential proxy services.","Identifying and remediating insecure or unapproved software components, including proxy SDKs, is a core flaw remediation function that would have prevented unauthorized proxy enrollment.","Continuous monitoring of network traffic, particularly outbound egress flows, would have detected the anomalous connections to 28 residential proxy services far earlier than external researchers did.","Regular scanning of internal endpoints would have flagged the presence of unauthorized or vulnerable proxy SDKs before they could enroll government systems into external proxy networks.","A formal process for identifying and managing technical vulnerabilities, including unauthorized third-party components, would have surfaced the proxy SDK risk before external exposure occurred.","Controlling which software and network communications are authorized on government systems would have restricted proxy SDKs from establishing outbound connections without explicit approval.","published","2026-11-06T23:21:01.039402+00:00","2026-11-06T23:21:01.021+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fsecurityaffairs.com\u002F202563\u002Fsecurity\u002Fwhite-house-network-appears-in-global-residential-proxy-traffic.html","white-house-network-appears-in-global-residential-proxy-traffic-8ca831","White House Network Appears in Global Residential Proxy Traffic",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[55,59,63],{"slug":56,"name":57,"problem":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":60,"name":61,"problem":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":64,"name":65,"problem":66},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen."]