CLASSIFIED // FOR EXERCISE USE OP CODE LOHA-PATH
DPDP Act 2023 ABDM HFR/ABHA NABH 5th Ed ICMR NIE MOHFW Cyber CERT-In 6h
T+00:00:00
CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · NINE · ZERO  ·  BRIEFING BEGINS
OPERATION DESIGNATOR
NATIONAL CYBER EXERCISE DIRECTORATE HEALTHCARE CII · 2026
OPERATION CODENAME
OPERATION LOHA-PATH
INITIATED 02:00 IST 17 MAY 2026 WINDOW T+0 → T+24h ARD · AURORA RAILWAY DIVISION
ALL ORGANISATIONS, PERSONNEL, STATION CODES, TRAIN NUMBERS FICTIONAL · AURORA RAILWAY DIVISION SIMULATED · REGULATORY REFERENCES (RAILWAYS ACT 1989 · RDSO SEM/TEM · RDSO TPWS-2017 · CRS MANUAL · IR GENERAL RULES · DPDP ACT 2023 · CERT-IN · NCIIPC · BHARATIYA NYAYA SANHITA 2023) REAL
AURORA RAILWAY DIVISION · CRIS + TMS + SIGNALLING (FICTIONAL) ICG AURORA NC3I · CRS-7 RADAR · 60 nm PORT ANUJA AIS-3 AIS-4 GHOST FLEET 21°45N 87°30E ROCKET-1 · MPA DEFENCE-IN-DEPTH AURORA-CITY N 50 KM
SITUATION REPORT
02:00 AMHMC HIS portal WAF flags SQL-injection probes on /his/patient-lookup + admin_credentials read attempt.
02:09 SMB lateral storm from HIS-Backend to EMR/LIS/PACS clusters using svc-his-admin.
02:15 VSS shadow copies destroyed on EMR/LIS/PACS — ransomware deployment begins; .vyadhi extension spreading.
02:20 6 ICU patient monitors show false-normal vitals — Bed 11 actual SpO2 86%, monitor displays 98%.
02:22 ICU Charge Nurse invokes NABH IMS Section 5.4 paper-downtime — paper observation charts + verbal orders + dual-nurse verification active.
Attribution preliminary: APT-VYADHI — state-aligned healthcare ransomware/exfil actor.
THREAT ACTOR PROFILE
REDACTED
APT · VYADHI
STATE-ALIGNED · HEALTHCARE RANSOMWARE
FIRST OBSERVED Q1 2026
CATALOGUED IN NTRO-IR-2026-07

CAPABILITY MATRIX

Hospital HIS Portal Exploitation
89
AD-Trust Shared-Credential Lateral
93
VSS Destruction + Ransomware Deploy
86
ICU Patient Monitor Tamper
74
ABDM-HFR API Bulk Exfil Attempts
68

OBSERVED TTPs · MITRE ATT&CK + ICS

INITIALT1190 HIS Portal SQLi CREDT1003.001 LSASS LATERALT1021.002 SMB DEFEVAT1490 VSS Destroy IMPACTT1486 Data Encrypted IMPACTT1485 Data Destruction ICST0832 ICU Monitor Tamper EXFILT1565.001 ABDM-API EXFILT1041 (RATE-LIMIT FAIL)
ICG STATION AURORA · COASTAL RADAR CHAIN + NC3I OVERLAY
⚠ FROZEN 98 SpO2 BED 11 · SPOOFED ⚠ FROZEN 78 HR BED 5 · SPOOFED NORMAL 96 SpO2 BED 7 · OK EMR ENCR PAPER CHART VERBAL CHARGE ICU NURSE STATION · PAPER MODE AMHMC ICU · 14 BEDS · NABH 5TH ED APT-VYADHI STATE · HEALTHCARE HIS PORTAL AMHMC web HIS-DB EMR .vyadhi ENCR LIS PACS ABDM GW rate-limit held ICU MONITOR T0832 tamper CHARGE WS Sr R.Bhattacharya OFFLINE BACKUP VAULT Air-gapped · 24h fresh 4-6 h restore window DPDP Section 8(4) SAFEGUARD NABH PAPER DOWNTIME Paper obs charts · q15 Verbal orders + dual-RN NABH IMS Section 5.4 AMHMC · AURORA MULTI-SPECIALTY HOSPITAL NABH 5TH-ED 600-BED TERTIARY · ICU CYBER INCIDENT (FICTIONAL) T+22 MIN · PAPER DOWNTIME ACTIVE
HEALTHY NODE ABDM RATE-LIMIT HELD RANSOMWARE / TAMPER NABH PAPER + DPDP Section 8(4) · DEFENCE-IN-DEPTH
MISSION OBJECTIVES
01
Detect HIS portal SQL-injection
WAF block + HIS-admin rotation; Hospital 30-min immediate-brief clock
T+10 min
02
VLAN-isolate EMR + LIS + PACS clusters
Emergency 10.20.0.0/24 ACL on SMB-lateral detection; CERT-In 6h starts
T+15 min
03
Verify DPDP Section 8(4) offline backup safeguard
Air-gapped vault <24h fresh, integrity hash intact; 4-6h restore window
T+20 min
04
ICU Charge Nurse invokes NABH paper downtime
Paper observation q15 + manual IV titration + verbal dual-RN orders (NABH IMS Section 5.4)
T+22 min
05
Confirm ABDM-API rate-limit holds
Bulk ABHA exfil blocked at 50 reads per 10 min per HIP; only 50 IDs exposed
T+30 min
06
File 6-clock regulatory submissions
Hospital 30 m + NABH 24 h + DPDP-DPB 72 h + CERT-In + NCIIPC 6 h + ABDM 24 h
T+30 m / T+72 h
RULES OF ENGAGEMENT

PERMITTED

  • All actions within exercise subnet 10.50.0.0/16
  • Defensive WAF rules, AD revocation, EMR/LIS/PACS VLAN isolation
  • Forensic collection from any in-scope hospital host (hash-first discipline)
  • Direct bedside + paper-chart cross-checks (no cyber dependency)
  • ICU Charge Nurse NABH paper-downtime invocation (unconditional)

PROHIBITED

  • Any interaction with paper observation charts or manual bedside procedures
  • Any interaction with the air-gapped offline backup vault via cyber means
  • Any actual patient-data manipulation (PHI in exercise is simulated only)
  • Ransom-payment consideration — formally prohibited by Board policy
  • Unilateral DPDP-DPB or NABH filings without DPO + NABH Compliance concurrence
REGULATORY CLOCKS · HEALTHCARE + INDIA
30m
IMMEDIATE
HOSPITAL
30-min
incident brief
72h
NOTIFY
DPDP-DPB
DPDP Section 8(6)
72-h notify
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
24h
COMPL
NABH
5th Ed IMS Section 5.4
24-h brief
MISSION LIVE IN
3
…