INDUSTRY FACT FILE · IT SERVICES & SYSTEMS INTEGRATION

Five New Case Studies in IT Services Security

Original 2026 case studies, each written as a blog post, showing how current threats play out for IT service firms and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Update That Shipped a Backdoor 3.  Case Study 2: The RMM Console That Ran Everyone's Ransomware 4.  Case Study 3: The Repository That Held the Client's Keys 5.  Case Study 4: The Contractor Who Kept the VPN 6.  Case Study 5: The AI Assistant That Shared Client Code

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed among IT service providers with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, the DPDP framework and client regulators' third-party requirements.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Provider type	Core threat	Regulatory lens	Primary bundles
1. The Update That Shipped a Backdoor	Software product vendor	Build and release compromise	CERT-In; client contracts; EU CRA	B2, B7, B8
2. The RMM Console That Ran Everyone's Ransomware	Managed service provider	Remote-management tool abuse	CERT-In; client regulator flow-down	B3, B7, B8
3. The Repository That Held the Client's Keys	Software developer	Secret leakage in code repositories	CERT-In; DPDP; client contracts	B2, B3, B7
4. The Contractor Who Kept the VPN	System integrator	Orphaned subcontractor access	Client contracts; DPDP; CERT-In	B9, B7, B5
5. The AI Assistant That Shared Client Code	Product engineering firm	Confidential code leaked to public AI tools	Client contracts; DPDP	B11, B6, B5

The update was signed by the vendor. That was the problem.

At a glance
Organisation	A software vendor (“Vendor A”) whose product is installed at dozens of enterprise clients
Threat	Malicious code inserted into a signed release through a compromised developer laptop
Why it is new	Supply-chain attacks turn trusted updates into delivery mechanisms
Codec Networks services	DevSecOps and pipeline review, SOC monitoring, incident response (Bundles B2, B7, B8)

The scenario

A developer's laptop was infected through a malicious browser extension. The attacker found stored credentials for the build server.

The attacker modified the build script to add a small backdoor to the next release, which was signed automatically.

Clients installed the update. Weeks later a client's SOC spotted unusual outbound connections, and Vendor A had to recall the release.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Build credentials were stored on developer laptops.
• Builds were signed automatically without review.
• No SBOM or artefact verification before release.
• Developer endpoints lacked EDR monitoring.

The impact

Vendor A faced client incident costs, contract claims, CERT-In reporting and lasting reputational damage.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Client contracts: security warranties, notification and indemnity obligations.
• EU Cyber Resilience Act: reporting of actively exploited vulnerabilities and severe incidents for products sold in the EU, from September 2026.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden the pipeline	Build isolation, signing and release review	B2
Watch developers	EDR and SOC monitoring of developer endpoints	B7
Respond together	Supply-chain incident response and client coordination	B8

Key lessons Keep build credentials off laptops. Review before you sign. Ship an SBOM with every release. Monitor developer endpoints.

One login. Forty clients. One night.

At a glance
Organisation	An MSP (“MSP B”) managing endpoints for about forty mid-sized clients
Threat	A phished RMM login used to deploy ransomware to client endpoints
Why it is new	RMM tools concentrate privileged access across many organisations
Codec Networks services	RMM and PAM testing, managed SOC, incident response (Bundles B3, B7, B8)

The scenario

An MSP B engineer entered credentials on a fake RMM login page. MFA was not enforced for that console.

The attacker logged in at night and pushed a script that disabled security tools and deployed ransomware across client endpoints.

By morning many clients were offline. Several were banks' vendors and had to inform their own clients and regulators.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No phishing-resistant MFA on the RMM console.
• Mass actions needed no approval.
• RMM activity was not monitored out of hours.
• Clients shared tooling tenants and credentials.

The impact

MSP B faced contract terminations, claims, CERT-In reporting and scrutiny from clients' regulators.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• RBI IT outsourcing Directions and SEBI CSCRF: regulated clients must oversee providers and may report provider-caused incidents.
• Client contracts: security, notification and liability clauses.

How Codec Networks would help

Need	Codec Networks response	Bundle
Lock the console	RMM and PAM testing, MFA and approval controls	B3
Watch the night	24x7 SOC monitoring of RMM activity	B7
Recover clients	Ransomware response and recovery support	B8

Key lessons Enforce phishing-resistant MFA on RMM. Require approval for mass actions. Monitor privileged tools 24x7. Segment clients from each other.

The keys were public for eleven minutes. That was enough.

At a glance
Organisation	A development firm (“Developer C”) building a cloud application for a retail client
Threat	Cloud access keys committed to a public repository and harvested by bots
Why it is new	Automated scanners find exposed secrets almost instantly
Codec Networks services	Secrets scanning, cloud review, SOC monitoring (Bundles B2, B3, B7)

The scenario

A developer pushed a configuration file with the client's cloud access keys to a public repository by mistake, then deleted it eleven minutes later.

Automated bots had already copied the keys. The attacker created compute resources and copied customer data from storage.

The client noticed an unusual cloud bill and a data-loss alert days later.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No secret scanning in IDEs or pipelines.
• Long-lived keys with broad permissions.
• No cloud anomaly monitoring.
• Deleting the commit was treated as remediation.

The impact

The client faced a data breach and CERT-In reporting, and Developer C faced an indemnity claim and lost the account.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• DPDP Act and Rules: the client as data fiduciary must ensure safeguards and, once provisions commence, intimate breaches.
• Client contracts: confidentiality and security obligations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Stop the leak	Secrets scanning and code review	B2
Shrink the blast radius	Cloud IAM and posture review	B3
Spot misuse	Cloud anomaly monitoring	B7

Key lessons Scan for secrets before every push. Use short-lived, least-privilege keys. Rotate keys immediately after exposure. Monitor cloud usage for anomalies.

The project ended. The access did not.

At a glance
Organisation	A system integrator (“Integrator D”) implementing an ERP for a manufacturing client
Threat	A former subcontractor engineer's VPN and admin accounts reused months after exit
Why it is new	Large, rotating delivery teams leave dormant accounts behind
Codec Networks services	Third-party assurance, UEBA monitoring, access governance (Bundles B9, B7, B5)

The scenario

A subcontractor engineer left the project, but the client VPN and ERP admin accounts were never revoked.

Months later the account was used—by the former engineer or someone who obtained the credentials—to log in and copy sensitive data.

The client's audit found that Integrator D had no process to track subcontractor access.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No joiner-mover-leaver process for subcontractors.
• Access was never recertified.
• Dormant account reuse raised no alert.
• Subcontractor security was not assessed.

The impact

Integrator D faced a client audit, contract penalties and reputational damage; the client reported the incident.

The regulatory lens

• Client contracts: access control, confidentiality and audit obligations.
• CERT-In Directions: incidents reported within six hours.
• DPDP Act and Rules: safeguards for personal data once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assure subcontractors	Third-party and staffing assessments	B9
Spot reuse	UEBA on dormant and unusual accounts	B7
Govern access	Access lifecycle and recertification process	B5

Key lessons Track every subcontractor account. Recertify client access quarterly. Alert on dormant account use. Assess staffing partners.

The code ran faster. The client's secrets travelled further.

At a glance
Organisation	A product engineering firm (“Firm E”) building a payments product for a client
Threat	Developers pasting proprietary client code and credentials into a public AI assistant
Why it is new	AI coding tools are adopted faster than policies
Codec Networks services	AI governance, DLP, policy and training (Bundles B11, B6, B5)

The scenario

To speed up delivery, developers pasted large blocks of client code—including configuration with credentials—into a free public AI assistant.

The client's security team, reviewing its own exposure, found code fragments associated with its product in a third-party service.

The client alleged a breach of confidentiality and demanded an audit of AI tool usage.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No approved AI tools or usage policy.
• No DLP for code and secrets.
• Developers were not trained on AI risks.
• Contracts did not address AI tool use.

The impact

Firm E faced a contractual dispute, rotated exposed credentials and paused AI-assisted work for the client.

The regulatory lens

• Client contracts: confidentiality and IP obligations.
• DPDP Act and Rules: safeguards where personal data is involved, once provisions commence.
• Client regulators: regulated clients may need to assess provider AI use under third-party rules.

How Codec Networks would help

Need	Codec Networks response	Bundle
Govern AI use	AI governance and approved tooling review	B11
Protect code	DLP for code and secrets	B6
Set the rules	AI usage policy and developer training	B5

Key lessons Approve enterprise AI tools. Never paste secrets into AI. Deploy DLP for code. Agree AI use with clients.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com