CLASSIFIED // FOR EXERCISE USE OP CODE CHAKRAVYUH
NCSC India DCyA Tri-Svc DGQA TEMPEST DPP 2020 CMVP FIPS 140-3 CERT-In 6h
T+00:00:00
CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · NINE · ZERO  ·  BRIEFING BEGINS
OPERATION DESIGNATOR
NATIONAL CYBER EXERCISE DIRECTORATE DEFENCE ACQUISITION · 2026
OPERATION CODENAME
OPERATION CHAKRAVYUH
INITIATED 02:00 IST 17 MAY 2026 WINDOW T+0 → T+12h SDSIL AURORA · DEFENCE INTEGRATOR
ALL ORGANISATIONS, PERSONNEL, INTEGRATOR NAMES FICTIONAL · SDSIL, AURORA DEFENCE CORRIDOR, AURORA MISSION BUILD · REGULATORY REFERENCES (NCSC INDIA · DCYA · NTRO · DGQA · DPP 2020 · CMVP FIPS 140-3 · CERT-IN · NCIIPC · OFFICIAL SECRETS ACT) REAL
AURORA DEFENCE CORRIDOR · SDSIL OPERATIONS AOR (FICTIONAL) ICG AURORA NC3I · CRS-7 RADAR · 60 nm PORT ANUJA AIS-3 AIS-4 GHOST FLEET 21°45N 87°30E ROCKET-1 · MPA DEFENCE-IN-DEPTH AURORA-CITY N 50 KM
SITUATION REPORT
02:05 SDSIL corporate VPN audit flags auth from non-allow-list IP using Tier-2 vendor service account; NTRO intel feed correlates IP to APT-BHRAMARI staging.
02:17 Senior developer workstation Endpoint Defender logs macro execution on "DRDO-Programme-Advisory-Q2-FY26.docm"; second-stage beacon confirmed.
02:32 Code-signing HSM service records an unauthorised signing operation outside the JIRA change-request window — CMVP dual-control bypassed.
02:53 Corporate USB write block on CI/CD server + data-diode RX-side ingress attempt logged-and-discarded at the optical-line layer.
03:00 RED-side independent SHA verifier QUARANTINES the signed-tamper artefact — dual-control attestation filed.
Attribution preliminary: APT-BHRAMARI — state-aligned defence-supply-chain actor, Tier-2 to CI/CD chain previously observed.
THREAT ACTOR PROFILE
REDACTED
APT · BHRAMARI
STATE-ALIGNED · DEFENCE SUPPLY-CHAIN
FIRST OBSERVED Q1 2026
CATALOGUED IN NTRO-IR-2026-04

CAPABILITY MATRIX

Tier-2 Vendor Compromise
89
DRDO-pretext Spearphish
93
Code-Signing HSM Bypass
86
CI/CD Pipeline Tamper
74
Operational Persistence (4-8 weeks)
68

OBSERVED TTPs · MITRE ATT&CK + ICS

INITIALT1195.001 Tier-2 Supply INITIALT1133 VPN Exploit INITIALT1566.001 Spearphish CREDT1003.001 LSASS CREDT1552.004 Signing Key LATERALT1021.002 SMB IMPACTT1554 Artefact Tamper LATERALT1091 Removable Media ICST0820 Air-Gap Exploit (FAIL)
ICG STATION AURORA · COASTAL RADAR CHAIN + NC3I OVERLAY
CLASSIFIED MISSION SYSTEM Aurora Mission Build v4.2.1 RED SIDE · CLASSIFIED Independent SHA verifier · dual-control RED-VERIFY SHA dual-ctrl RED-DEPLOY mission lab DIODE TX-ONLY AIR-GAP BLACK SIDE · UNCLASSIFIED CORPORATE VPN · Dev WS · AD · Code-signing HSM · CI/CD VPN corporate gw DEV-WS R.SHARMA AD site domain CODESIGN HSM FIPS 140-3 CI/CD build server TIER-2 VENDOR Aurora Electronics APT-BHRAMARI STATE-ALIGNED · SUPPLY-CHAIN DCyA SOC Tri-Svc IDS · NTRO feed LAYER 1 · HARDWARE AIR-GAP Fibre TX-only · RX dead-end USB-disable + endpoint allow-list DGQA TEMPEST · CMVP FIPS 140-3 LAYER 2 · RED-SIDE SHA Separate signing authority Dual-control (Lt Col + Lt Cdr) DPP 2020 · Common Criteria EAL 4+ SDSIL AURORA · DEFENCE-ACQUISITION SUPPLY CHAIN CHAKRAVYUH CONCENTRIC FORMATION · BLACK → AIR-GAP → RED (FICTIONAL) T+30 MIN · DEFENCE-IN-DEPTH LAYERS HELD
BLACK SIDE NODE AIR-GAP / DIODE HOSTILE / ATTACK FLOW RED SIDE · DEFENCE-IN-DEPTH
MISSION OBJECTIVES
01
Detect Tier-2 vendor VPN-auth anomaly
Force supplier-credential rotation + apply IP-allow-list enforcement; NTRO IOC cross-org sharing within 15 min
T+5 min
02
Quarantine compromised dev WS + revoke HSM access
Endpoint isolation + CMVP dual-control key rotation; close RBAC audit-gap (developer → HSM signing path)
T+18 min
03
Verify defence-in-depth Layer 1 (hardware air-gap)
DGQA TEMPEST officer attestation citing CMVP FIPS 140-3 + Common Criteria EAL 4+; USB block + diode RX-attempt logged
T+25 min
04
Verify defence-in-depth Layer 2 (RED-side SHA)
RED-side independent SHA verifier QUARANTINEs the signed-tamper artefact; dual-control by two cleared officers per DPP 2020
T+30 min
05
File DCyA + NCSC India briefs
DCyA immediate brief (30 min) + NCSC India strategic advisory (1 h)
T+30 / T+60 min
06
File CERT-In + NCIIPC + DRDO submissions
CERT-In Annexure-I(B) + NCIIPC Section 70 (6 h) + DRDO programme-office notification (12 h)
T+6 / T+12 h
RULES OF ENGAGEMENT

PERMITTED

  • All actions within exercise subnet 10.50.0.0/16
  • Defensive AD revocation, WAF rules, endpoint isolation
  • HSM key rotation with CMVP dual-control sign-off
  • Forensic collection from any in-scope BLACK-side host (hash-first discipline)
  • Request DGQA TEMPEST + RED-side dual-control attestations

PROHIBITED

  • Any interaction with the RED-side networks via cyber means (no path exists by design)
  • Any interaction with the DGQA TEMPEST attestation chain (out-of-band classified)
  • Out-of-band channels — personal phone, public email, social
  • Persistent backdoors, exfiltration to non-exercise endpoints
  • Unilateral DCyA or NCSC India filings without Privacy Officer concurrence
REGULATORY CLOCKS · INDIA DEFENCE
30m
IMMEDIATE
DCyA
Tri-Svc IDS
immediate brief
1h
ADVISORY
NCSC INDIA
PMO advisory
strategic
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
12h
NOTIFY
DRDO
Programme
office notify
MISSION LIVE IN
3
…