CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · ONE · SEVEN · BRIEFING BEGINS
OPERATION DESIGNATOR
OPERATION CODENAME
OPERATION NEELKANTH
AFFECTED REGION
SITUATION REPORT
04:18 Network anomalies detected on POSOCO Northern Load Dispatch Centre SCADA gateway.
04:24 Lateral movement observed into 400 kV substation SS-7 control LAN.
04:29 Unauthorised Modbus write operations on relay protection IEDs. Confirmed adversarial.
04:30 Concurrent intrusion attempt on regional banking payment gateway. Suspected diversion.
Attribution preliminary: APT-Bharat-Echo-Seven — TTPs match prior catalogued operations.
THREAT ACTOR PROFILE
APT · BE-7
STATE-ALIGNED · HIGH
FIRST OBSERVED Q2 2024
CATALOGUED IN NTRO-IR-441
CATALOGUED IN NTRO-IR-441
CAPABILITY MATRIX
OBSERVED TTPs · MITRE ATT&CK
INITIALT1566.001
EXECT1059.001
PERSISTT1543.003
LATERALT1021.002
ICST0831 Manipulation of Control
ICST0815 Denial of View
ICST0857 System Firmware
TARGET ASSETS · TOPOLOGY
MISSION OBJECTIVES
01
Contain & isolate the intrusion
Sever adversary access to OT segment without destabilising grid frequency
T+60 min
02
Preserve forensic evidence
Capture volatile memory, PCAPs, SCADA event logs before remediation
T+90 min
03
Submit CERT-In incident report
Annexure-I(B), six-hour regulatory window from confirmed detection
T+6 h
04
Restore service continuity
Verified clean failover, banking gateway online, grid telemetry trustworthy
T+8 h
RULES OF ENGAGEMENT
PERMITTED
- All actions within designated lab subnet 10.50.0.0/16
- Defensive blocking, isolation, kill-chain disruption
- Forensic collection from any in-scope host
- Communication via secure exercise channel only
PROHIBITED
- Any interaction with production assets, public IPs, vendor cloud
- Out-of-band channels — personal phone, public email, social
- Disclosure of exercise content outside cleared personnel
- Persistent backdoors, exfil to non-exercise endpoints
REGULATORY CLOCKS · INDIA
1h
INITIAL
NLDC
Power-grid event
initial intimation
initial intimation
2-6h
REPORT
RBI
Cyber-incident
Annex 1.10 (2016)
Annex 1.10 (2016)
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
Annexure-I(B)
6h
NOTIFY
NCIIPC
CII operators
IT Act Section 70 framework
IT Act Section 70 framework
MISSION LIVE IN
3