CLASSIFIED // FOR EXERCISE USE OP CODE NEELAM-DRISHTI
IMO MSC.428(98) BIMCO v4 ISPS Code DGS MS Act CERT-In 6h NCIIPC Section 70
T+00:00:00
CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · NINE · ZERO  ·  BRIEFING BEGINS
OPERATION DESIGNATOR
NATIONAL CYBER EXERCISE DIRECTORATE MARITIME · COASTAL NC3I · 2026
OPERATION CODENAME
OPERATION NEELAM-DRISHTI
INITIATED 02:00 IST 17 MAY 2026 WINDOW T+0 → T+24h ICG STATION AURORA · NC3I
ALL ORGANISATIONS, PERSONNEL, PLANT NAMES FICTIONAL · ICG STATION AURORA, AURORA COASTAL PROVINCE, PORT ANUJA · REGULATORY REFERENCES (IMO MSC.428 · BIMCO · ISPS · DGS · CERT-In · NCIIPC) REAL
AURORA COASTAL PROVINCE · BAY-OF-AURORA AOR (FICTIONAL) ICG AURORA NC3I · CRS-7 RADAR · 60 nm PORT ANUJA AIS-3 AIS-4 GHOST FLEET 21°45N 87°30E ROCKET-1 · MPA DEFENCE-IN-DEPTH AURORA-CITY N 50 KM
SITUATION REPORT
02:03 Port Anuja VTMS portal WAF flags repeated SQL-injection probes against /vtms/vessel-lookup. Webshell artefact dropped to /var/www/uploads.
02:12 Unexpected SSH session from port-authority workstation to AIS Shore Station 3 using svc-port-auth.
02:22 Ghost fishing-fleet AIS contacts at Bay-of-Aurora 21°45N 87°30E. Initial radar negative, then radar agreement within 3 min. NRSC reference disagrees.
02:35 MTOC tactical-picture display frozen on ghost contacts. NC3I central malformed-message flood at 1,840/sec.
02:48 Dornier-228 ROCKET-1 MPA flyover: NO vessels at 21°45N 87°30E. Cyber-spoofed picture disproven.
Attribution preliminary: APT-CYCLONE — state-aligned maritime cyber actor, VTMS-to-AIS chain previously observed.
THREAT ACTOR PROFILE
REDACTED
APT · CYCLONE
STATE-ALIGNED · MARITIME CYBER
FIRST OBSERVED Q1 2026
CATALOGUED IN NTRO-IR-742

CAPABILITY MATRIX

VTMS / Port Web Exploitation
89
AIS Feed Manipulation
93
Coastal Radar Bearing Tamper
86
NC3I Central DoS / Display Freeze
74
Operational Persistence (12-30 h)
68

OBSERVED TTPs · MITRE ATT&CK + ICS

INITIALT1190 Public-Facing App CREDT1003.001 LSASS LATERALT1021.004 SSH LATERALT1021.002 SMB IMPACTT1565.001 AIS Spoof ICST0832 Manipulation of View ICST0815 Denial of View (MTOC) IMPACTT1499 NC3I DoS ICST0855 Unauth Cmd Msg
ICG STATION AURORA · COASTAL RADAR CHAIN + NC3I OVERLAY
ICG STATION AURORA CRS-7 AIS-3 CRS-8 AIS-4 MTOC AURORA PORT ANUJA · VTMS GHOST FLEET 21°45'N 87°30'E (FICTIONAL) AIS SPOOF · NO ACTUAL VESSELS ROCKET-1 DORNIER-228 · MPA APT-CYCLONE EXTERNAL · MARITIME VTMS Port portal VTMS-DB PORT-WS Port Authority AIS-3 AIS-4 CRS-7 CRS-8 NC3I Aurora central MTOC-WS Watch console MPA · ROCKET-1 PHYSICAL VERIFICATION LAYER NO CYBER PATH · ICG AIR ENCLAVE VHF IMO MSC.428(98) DEFENCE-IN-DEPTH ICG STATION AURORA · BAY-OF-AURORA AOR COASTAL RADAR CHAIN + NC3I AGGREGATOR + MTOC WATCH (FICTIONAL) T+25 MIN · MPA VERIFICATION INBOUND
HEALTHY I&C NODE NC3I DoS / MTOC FREEZE HOSTILE / ATTACK FLOW MPA · DEFENCE-IN-DEPTH
MISSION OBJECTIVES
01
Contain the VTMS exploit + lateral chain
Apply WAF rule on Port Anuja VTMS portal, revoke svc-port-auth, isolate AIS Shore Station 3 from NC3I conduit
T+15 min
02
Recognise AIS-vs-radar spoof signature
Cross-check AIS+radar agreement vs NRSC ground-station-augmented reference; sudden-agreement pattern is the spoof tell
T+25 min
03
Task MPA Dornier-228 ROCKET-1 flyover
Physical verification via ICG Air Enclave VHF (independent of cyber tier). The defence-in-depth activation moment
T+25 min
04
File ICG MTOC immediate brief + DGShipping advisory
ICG MTOC 30-min clock + DGShipping coastal-traffic advisory 1-h clock; broadcast confirmed-fictitious to regional fleet
T+30 / T+60 min
05
File CERT-In + NCIIPC notifications
Annexure-I(B) + IT Act Section 70 CII reports within the 6-hour clock
T+6 h
06
File IMO MSC.428(98) IR pack
Maritime Cyber Risk Management IR pack within 24 h. Defence-in-depth attestation via MPA verification report
T+24 h
RULES OF ENGAGEMENT

PERMITTED

  • All actions within exercise subnet 10.50.0.0/16
  • Defensive WAF rules, AD revocation, conduit firewall rules
  • Forensic collection from any in-scope host (hash-first discipline)
  • MPA tasking via ICG Air Enclave VHF (independent verification path)
  • Verbal briefing across Watch Officer / Cyber Cell / ICG Liaison

PROHIBITED

  • Any interaction with the ICG Air Enclave VHF tasking channel (no cyber path by design)
  • Any interaction with NRSC ground-station-augmented reference feed
  • Out-of-band channels — personal phone, public email, social
  • Persistent backdoors, exfiltration to non-exercise endpoints
  • Unilateral DGShipping advisory or CERT-In filings without ICG Liaison concurrence
REGULATORY CLOCKS · INDIA + IMO
30m
IMMEDIATE
ICG MTOC
MTOC SOP
watch brief
1h
ADVISORY
DGSHIPPING
MS Act 1958
coastal traffic
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
24h
IR PACK
IMO MSC.428
Maritime Cyber
Risk Mgmt
MISSION LIVE IN
3
…