[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSRQg7MbwIcYtx-ru7CkN2XL5A7mk9ryfyQJdXNWtkcA":3},{"article":4,"iocs":51,"watch_terms":55,"solutions":56,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":33},"94ed70df-d974-4540-8cc2-fe514e6d57f4","Want to Rent an Internet Address at the White House?","want-to-rent-an-internet-address-at-the-white-house-a268ea","Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder's web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.","Security experts have detected residential proxy nodes operating from the White House's Executive Office of the President network. These services, often integrated into free applications, allow users to rent out their internet addresses, potentially exposing sensitive networks to malicious actors. One identified service, Infatica, is linked to a Russian company whose founder has past ties to election system cyberattacks.","White House staffers' devices are being used for residential proxy services, potentially exposing sensitive networks.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F11\u002Fwant-to-rent-an-internet-address-at-the-white-house\u002F",null,"2026-11-05T04:36:17+00:00","2026-11-05T05:00:22.587131+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"Layer3 Intel","vendor",{"name":21,"type":19},"Synthient",{"name":23,"type":24},"Infatica","product",{"name":26,"type":19},"King Servers",{"name":28,"type":24},"Windows 11","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":12,"name":31,"slug":32},"Threat Intelligence","threat-intelligence",[34,39,44,49],{"category":35},{"id":36,"icon":12,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":12,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":29,"icon":12,"name":31,"slug":32},[52],{"type":53,"value":23,"context":54},"malware","Proxy program integrated into mobile and desktop applications detected on White House devices.",[18,21,26],{"controls":57,"vendors":136},[58,86,107],{"slug":59,"name":60,"problem":61,"products":62},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[63,71,78],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":73,"url":76,"description":77},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[91,99],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":108,"name":109,"problem":110,"products":111},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"residential-proxy-nodes-found-operating-inside-white-house-network","Residential Proxy Nodes Found Operating Inside White House Network","Residential proxy software — typically bundled silently into free applications — was discovered operating on the Executive Office of the President's network, effectively renting out government IP addresses to unknown third parties. The root cause is a failure of software inventory and configuration governance: unauthorized or unvetted applications were allowed to install and run on a highly sensitive network. This matters enormously because adversaries can abuse these proxy nodes to launder malicious traffic, conduct reconnaissance, or pivot deeper into government infrastructure while appearing to originate from a trusted U.S. government address. The involvement of a service linked to a Russian-founded company with ties to election system cyberattacks elevates the national security implications significantly.",[142,143,144,145,146,147,148],"CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy","NIS2 Article 21(2)(b)","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":150,"MITRE ATT&CK T1090: Proxy":151,"NIST SP 800-53 SI-2: Flaw Remediation":152,"CIS Control 13: Network Monitoring and Defense":153,"CIS Control 2: Inventory and Control of Software Assets":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 requires incident handling and supply chain security measures; the presence of software tied to a foreign-linked company on critical government infrastructure highlights the need for mandatory supply chain risk assessments of all deployed software.","This technique — using a compromised or enrolled host as a proxy node — is precisely what the residential proxy services exploit, and defenders monitoring for anomalous proxy-like outbound traffic patterns would have detected it earlier.","Systematic scanning and remediation processes would have identified the unauthorized software component and triggered removal, limiting the exposure of the government network.","Continuous monitoring of outbound network traffic for peer-to-peer or proxy relay patterns would have detected the residential proxy nodes relaying traffic out of the White House network in near-real time.","Maintaining an authoritative inventory of authorized software would have flagged the unauthorized residential proxy agent running on government endpoints before it could be exploited.","A formal process for identifying and managing vulnerable or unauthorized software components would have surfaced the proxy agent and triggered an incident response before sensitive IP addresses were rented out.","Strict controls over what software and services are permitted to authenticate and communicate outbound from sensitive networks would have prevented the proxy service from establishing connections to external infrastructure."]