CLASSIFIED // FOR EXERCISE USE OP CODE ANU-SHAKTI
AERB SG-D-25 IAEA NSS-17 IEC 62443 CERT-In 6h NCIIPC Section 70
T+00:00:00
CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · NINE · ZERO  ·  BRIEFING BEGINS
OPERATION DESIGNATOR
NATIONAL CYBER EXERCISE DIRECTORATE NUCLEAR I&C · 2026
OPERATION CODENAME
OPERATION ANU-SHAKTI
INITIATED 02:00 IST 17 MAY 2026 WINDOW T+0 → T+6h KANPP-1 · 700 MWe PHWR
ALL ORGANISATIONS, PERSONNEL, PLANT NAMES FICTIONAL · KALINGA-ANUJA NPP, KALINGA COASTAL, KAPGL · REGULATORY + TECHNICAL REFERENCES (AERB · IAEA · IEC · CERT-In · NCIIPC) REAL
KALINGA COASTAL (FICTIONAL) KANPP-1 700 MWe · PHWR ANUJA-CITY VENDOR PORTAL SUPPLY-CHAIN N 50 KM
SITUATION REPORT
01:58 Engineering Workstation host-integrity monitor reports SHA-256 mismatch on patch bundle "OvationCare v3.4.1" pulled from OEM vendor portal.
02:08 Two spearphish emails masquerading as KAPGL Cyber Cell post-patch acknowledgement detected by mail gateway sandbox.
02:15 Unexpected SMB authentication from EWS to DCS Supervisor A using svc-kapgl-eng service account. Kerberoast SPN flood seen at Site AD.
02:30 Unauthorised Modbus FC 06 write attempted on Feedwater Control PLC — SG-1 setpoint register 0x2014. ICS firewall rule 1107 holds.
02:45 HMI vs Historian divergence on SG-1 level — denial-of-view via DCOM hijack on Operator console.
Attribution preliminary: APT-DHRUVA — state-aligned ICS specialist, supply-chain to Modbus chain previously observed.
THREAT ACTOR PROFILE
REDACTED
APT · DHRUVA
STATE-ALIGNED · ICS SPECIALIST
FIRST OBSERVED Q4 2024
CATALOGUED IN NTRO-IR-628

CAPABILITY MATRIX

Supply-chain Compromise
92
Spearphish (Targeted CII)
88
Custom ICS Payloads (Modbus/IEC-104)
95
Safety-System Manipulation Attempts
58
Operational Persistence (36-48 h)
81

OBSERVED TTPs · MITRE ATT&CK + ICS

INITIALT1195.002 Supply-Chain INITIALT1566.001 Phish-Attach CREDT1003.001 LSASS CREDT1558.003 Kerberoast LATERALT1021.002 SMB LATERALT1047 WMI ICST0831 Manipulation of Control ICST0858 Change Operating Mode ICST0815 Denial of View ICST0820 Exploitation for Evasion ICST0814 DoS (Historian)
KANPP-1 PLANT + DIGITAL I&C OVERLAY
SWITCHYARD · 400 kV GRID INTERCONNECTION TURBINE HALL · 700 MWe REACTOR BUILDING · KANPP-1 PHWR 700 · 392 FUEL CHANNELS SG-1 / SG-2 MAIN CONTROL ROOM · MCR ENGINEERING BLDG APT-DHRUVA EXTERNAL · STATE-ALIGNED VENDOR PORTAL OvationCare v3.4.1 (tampered) EWS Engineering WS AD Site Active Directory DCS-A DCS Supervisor A DCS-B DCS Supervisor B HIST Plant Historian OP-WS MCR Operator HMI FW-PLC Feedwater Control B-PLC Boron Control RPS · IEC 61226 Cat A HARD-WIRED ANALOGUE LOGIC NO CYBER PATH · AERB SG-D-25 Section 6 ⌀ DEFENCE-IN-DEPTH ⌀ KANPP-1 · KALINGA-ANUJA NUCLEAR POWER PROJECT KALINGA COASTAL · 700 MWe PHWR · DIGITAL I&C OVERLAY T+25 MIN · SAFETY LAYER HELD
HEALTHY I&C NODE DEGRADED / HMI FREEZE HOSTILE / ATTACK FLOW RPS · DEFENCE-IN-DEPTH
MISSION OBJECTIVES
01
Contain the supply-chain & lateral chain
Isolate EWS, revoke svc-kapgl-eng, block Modbus FC 06 at ICS firewall rule 1107 before SG-1 setpoint takes effect
T+30 min
02
Defeat the HMI denial-of-view
Detect Historian-vs-HMI divergence on SG-1 level; brief MCR Operator on actual reading via SES console
T+45 min
03
Verify RPS defence-in-depth
Design Authority attestation citing AERB SG-D-25 + IEC 61226 Cat A — RPS hard-wired analogue, unreachable from cyber layer
T+55 min
04
File AERB SG-D-25 preliminary report
Within the 1-hour regulatory clock from confirmed detection
T+1 h
05
File CERT-In + NCIIPC notifications
Annexure-I(B) + IT Act Section 70 CII reports within the 6-hour clock
T+6 h
06
Determine IAEA INES classification
Level 0-1 expected (defence-in-depth held, no release). Brief DAE Secretariat + AERB HQ for final classification
T+24 h
RULES OF ENGAGEMENT

PERMITTED

  • All actions within exercise subnet 10.50.0.0/16
  • Defensive blocking, isolation, conduit firewall rules
  • Forensic collection from any in-scope host (hash-first discipline)
  • Attempted enumeration of Boron Control PLC for RPS-INPUT-AVAIL (educational punchline)
  • Verbal briefing across MCR Operator / Shift Charge / I&C / Cyber Cell

PROHIBITED

  • Any interaction with the Reactor Protection System (no path exists)
  • Manual operator override of RPS trip signal at any time
  • Out-of-band channels — personal phone, public email, social
  • Persistent backdoors, exfiltration to non-exercise endpoints
  • Unilateral regulatory filings without Privacy Officer + AERB Liaison concurrence
REGULATORY CLOCKS · INDIA + IAEA
1h
PRELIM
AERB
Safety Guide
SG-D-25
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
6h
NOTIFY
NCIIPC
CII operators
IT Act Section 70
24h
CLASSIFY
IAEA INES
Lvl 0-1 expected
Additional Protocol
MISSION LIVE IN
3
…