White House network IPs reportedly used as residential proxy exit nodes
MALWARELayer3 Intelredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Layer3 Intel reports that 28 residential proxy services exited into the White House network almost daily between 5 October and 3 November, with 236 exits in that period, mostly in the evenings. The likely cause is an infected device running a proxy SDK, possibly Infatica, and Synthient believes several Windows 10 and 11 devices may have it installed. Layer3 warns that poorly secured proxy SDKs can allow lateral movement into internal systems, and the State Department has requested the logs.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check endpoints for unexpected proxy SDKs, such as the Infatica SDK, and remove any that are not authorised.
- Review VPN and free app terms to see whether they reuse your connection as an exit node, as the FBI has warned.
- Monitor network traffic for residential proxy exit activity, particularly during evening hours.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Register (Security)
Who and what is in it
Companies
Products
Government agencies