Integrity Technology Group paperwork reveals proxy and surveillance ties

At a glance

What this is: NHI Mgmt Group's analysis, drawing on KELA's report: A claimed Integrity Technology Group leak points to surveillance tooling, purchased proxy infrastructure and paperwork that supports state-linked covert capability.

Why it matters: Identity and access practitioners should note how infrastructure procurement, ownership structure and network provenance can all shape attribution, screening and trust decisions across NHI and third-party governance.

Context

A claimed breach can matter even when it is not authenticated, because the supporting material may still reveal how an organisation builds, routes and governs access infrastructure. In this case, the security issue is not only data exposure but the overlap between commercial procurement, covert routing capacity and state-linked cyber operations.

The identity and governance angle sits in the infrastructure itself: cloud phones, static residential proxy IPs, certificates and credentials are all artefacts that can support concealment, access persistence or operational relay. That makes procurement records and ownership chains relevant to security review, not just incident response.

Key questions

Q: How should teams verify the provenance of proxy infrastructure?

A: Teams should verify proxy provenance by tracing who procured the service, which organisations control the IP ranges, and whether the exit nodes map to declared infrastructure or known hosting providers. Useful checks include WHOIS, certificate and DNS history, cloud tenancy evidence, billing records, and route consistency. Unclear provenance weakens allow-listing, abuse investigation, and attribution of traffic sources.

Q: Why do static residential proxies complicate security detection?

A: Static residential proxies complicate security detection because they route traffic through long-lived consumer IP addresses that resemble ordinary home connectivity rather than datacentre infrastructure. That makes IP reputation, geolocation, and simple blocklists less reliable. Analysts then need additional signals such as session behaviour, device fingerprinting, DNS patterns, and authentication anomalies to distinguish legitimate users from masked automation.

Q: How do procurement records help with cyber attribution?

A: Procurement records help attribution by showing who bought the infrastructure, under what contract, from which reseller, and with which payment or business entity. Those records can link an IP range, proxy service, or hosting account to an operator, even when the network layer looks anonymous. They also support chain-of-custody, incident scoping, and later legal or disciplinary action.

Q: What should security teams do first when infrastructure provenance is uncertain?

A: The first step is to preserve evidence and narrow the uncertainty, not to jump to blocking. Security teams should capture logs, packet data, DNS records, timestamps, and any configuration or procurement artefacts, then establish whether the infrastructure is internal, third-party, or maliciously impersonated. That baseline supports safe containment decisions and reduces false attribution.

Technical breakdown

Why static residential proxies matter for covert routing

Static residential proxy infrastructure gives an operator a way to present traffic as if it originated from consumer networks while retaining central control over the relay layer. That matters because many detection models still treat residential ASN, domestic geolocation and plausible device fingerprints as weak trust signals. Once purchased at scale, those signals can be assembled into infrastructure that looks ordinary at the point of inspection but behaves like an operational relay network behind the scenes. The security problem is not the proxy itself, but the false legitimacy it creates across detection, geofencing and identity scoring. See the Residential Proxy Networks and Abuse Guide.

Practical implication: Treat residential origin as neutral evidence and validate it against ownership, reuse patterns and infrastructure behaviour.

How procurement records become attribution evidence

Procurement artefacts can expose capability that telemetry never sees. A payment agreement, acceptance report or white paper can reveal the kinds of systems an organisation bought, the counterparties involved, the scale of the deployment and the operational purpose of the environment. That is especially important in cases where sanctioned entities may route purchases through subsidiaries or contractors. In practice, paperwork can distinguish a compromised botnet from procured infrastructure, which changes how analysts interpret the activity and how compliance teams map ownership and exposure.

Practical implication: Correlate procurement, ownership and contract data with technical telemetry before concluding that infrastructure is attacker-controlled.

Why certificate and credential inventories are high-value artifacts

Certificates, signing requests and credential listings are not just administrative files. They often expose trust boundaries, device relationships, environment scope and the administrative workflows that bind systems together. When such artifacts appear alongside proxy inventory and cloud platform access, they can show how an operator sustains access across multiple services and regions. In a covert infrastructure context, that makes credential and certificate handling part of the security story, not a back-office detail.

Practical implication: Inventory certificates and cloud credentials with the same rigor as production secrets, including ownership and lifecycle review.

Threat narrative

Attacker objective: The objective appears to be exposure and monetisation of internal material that can reveal both infrastructure capability and the relationships behind it.

1. Entry occurred through a claimed archive of internal documents that could expose operating relationships, infrastructure procurement and trust material.
2. Credential and infrastructure evidence in the sample suggests access to certificates, cloud platform listings and routing assets rather than a single isolated file set.
3. Escalation came from the ability to correlate procurement, proxy and account records into a broader operational picture of covert capability.
4. Impact is attribution pressure, because the material can support or challenge claims about how the infrastructure was assembled and who controlled it.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Procurement can be part of covert infrastructure, not just a supporting detail. This case shows how purchased hosting, cloud phones and proxy capacity can sit inside the same operational stack as compromised devices. Analysts who focus only on malware or botnet telemetry miss the business-side evidence that often explains how the capability was assembled. The practitioner conclusion is to treat procurement records as part of threat intelligence, not as paperwork after the fact.

Static residential proxies create a legitimacy problem for security controls. When relays are bought in bulk, residential ASN and domestic geolocation stop being reliable indicators of benign origin. That breaks assumptions in fraud scoring, conditional access and bot detection, because the infrastructure can look local while serving an operational relay purpose. The practitioner conclusion is to demote residential origin from trust signal to one data point among many.

Ownership chains matter when sanctions and third-party risk intersect. The material suggests a structure where subsidiaries and counterparties may carry the operational load even when the parent company sits under scrutiny. That creates a governance gap for sanctions screening, supplier review and exposure mapping, because name-based checks can miss the real control path. The practitioner conclusion is to extend due diligence to beneficial ownership and named contracting entities.

Traffic decryption capability is a governance issue as much as a technical one. A surveillance system that can intercept hidden channels and extract hardware fingerprints turns network egress into an intelligence boundary. That means the organisation’s control problem is not only encryption strength but who is allowed to inspect, correlate and persist data at the edge. The practitioner conclusion is to align network inspection powers with formal governance and oversight.

Sanctions cases need a distinction between procured infrastructure and compromised infrastructure. KELA’s review underscores that these are different operational patterns with different telemetry, takedown paths and trust assumptions. A botnet made from hijacked endpoints does not behave like leased proxies, cloud nodes or bought device fleets. The practitioner conclusion is to classify infrastructure origin explicitly so detection and compliance teams do not collapse two different threat models into one.

What this signals

Procurement telemetry is becoming a security signal. When contracts, acceptance reports and payment agreements describe proxy fleets, cloud phones and certificate material, they can reveal operational capacity that never shows up in packet captures alone. Security programmes should start treating commercial records as part of the threat model, especially where state-linked activity or sanctions exposure is plausible.

Infrastructure trust is moving from location to ownership. A residential ASN or in-country IP block is no longer enough to establish benign use, because the same characteristics can be purchased and operationalised at scale. The practical shift is toward validating who controls the asset, how it is funded and whether it matches the claimed business purpose.

For practitioners

• Review infrastructure provenance before assigning trust Separate leased, purchased and compromised infrastructure in your casework, conditional access logic and fraud rules so residential origin is not treated as benign by default.
• Map procurement to ownership and control Extend screening beyond the named vendor to subsidiaries, counterparties and payment recipients that appear on contracts or acceptance paperwork.
• Inventory certificates and credential artifacts with lifecycle context Track certificate signing requests, .cer files, cloud credentials and related trust material as governed assets with ownership, scope and revocation paths.
• Differentiate proxy networks from botnets in detection rules Write separate classification logic for compromised endpoints and procured relay infrastructure, because the telemetry, geolocation and takedown options differ. See the Botnets Guide.
• Tune sanctions workflows to subsidiary structures Review whether your third-party and sanctions checks follow beneficial ownership and local contracting entities, not just the parent company name.

Key takeaways

• The most important risk in this case is not just exposure of documents but the way ordinary procurement can support covert routing and surveillance capacity.
• The sample material includes infrastructure clues, certificate artefacts and contract evidence that point to a broader operational stack than a single leak.
• Security teams should separate provenance, ownership and trust decisions so residential-looking infrastructure and subsidiary structures do not distort detection or compliance.

Related NHI Mgmt Group resources: Residential Proxy Networks and Abuse Guide · Data Security Guide · Botnets Guide

Key terms

• Botnet: A botnet is a collection of compromised devices that an attacker can remotely coordinate to carry out an attack. In DDoS scenarios, the devices act as distributed traffic generators, which makes the attack harder to block by source alone.
• Network Egress Inspection: Network Egress Inspection is the monitoring and analysis of outbound network traffic leaving a trusted environment. It examines destinations, protocols, payload indicators, and policy violations so teams can spot data exfiltration, command-and-control traffic, misrouted services, and suspicious proxy use.
• Proxy Fleet: Proxy Fleet is a collection of proxy servers used to relay traffic through multiple intermediate IP addresses. Operators use a fleet to distribute requests, balance load, or obscure the original source, and defenders assess it through IP ownership, routing behaviour, and traffic patterns.
• Residential Proxy: A residential proxy routes traffic through an address assigned to a real consumer device or household connection. That makes the traffic look more legitimate than datacentre-based proxies, which is why abuse actors use it to bypass reputation checks and blend into normal user traffic.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and IAM practitioners build the control model needed to govern trust, access and lifecycle risk.