CLASSIFIED // FOR EXERCISE USE OP CODE SAGAR-VRAJ
IMO MSC.428(98) SOLAS V/27 IACS UR E27 BIMCO v4 DGS 04-2022 CERT-In 6h
T+00:00:00
CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · NINE · ZERO  ·  BRIEFING BEGINS
OPERATION DESIGNATOR
NATIONAL CYBER EXERCISE DIRECTORATE MERCHANT MARINE · SHIP-SIDE · 2026
OPERATION CODENAME
OPERATION SAGAR-VRAJ
INITIATED 02:00 IST 17 MAY 2026 WINDOW T+0 → T+24h MV SAGAR-VARUN · IMO 9876543
ALL ORGANISATIONS, PERSONNEL, VESSEL NAMES FICTIONAL · MV SAGAR-VARUN, AURORA MARITIME LINES, MUMBAI → SINGAPORE VOYAGE · REGULATORY REFERENCES (IMO MSC.428 · SOLAS V/27 + V/34-1 · IACS UR E26/E27 · BIMCO · ISPS · ISM · DGSHIPPING 04-2022 · CERT-IN · NCIIPC) REAL
BAY OF BENGAL · ANDAMAN SEA · MV SAGAR-VARUN VOYAGE TRACK (FICTIONAL) ICG AURORA NC3I · CRS-7 RADAR · 60 nm PORT ANUJA AIS-3 AIS-4 GHOST FLEET 21°45N 87°30E ROCKET-1 · MPA DEFENCE-IN-DEPTH AURORA-CITY N 50 KM
SITUATION REPORT
02:05 SDSIL corporate VPN audit flags auth from non-allow-list IP using Tier-2 vendor service account; NTRO intel feed correlates IP to APT-BHRAMARI staging.
02:17 Senior developer workstation Endpoint Defender logs macro execution on "DRDO-Programme-Advisory-Q2-FY26.docm"; second-stage beacon confirmed.
02:32 Code-signing HSM service records an unauthorised signing operation outside the JIRA change-request window — CMVP dual-control bypassed.
02:53 Corporate USB write block on CI/CD server + data-diode RX-side ingress attempt logged-and-discarded at the optical-line layer.
03:00 RED-side independent SHA verifier QUARANTINES the signed-tamper artefact — dual-control attestation filed.
Attribution preliminary: APT-BHRAMARI — state-aligned defence-supply-chain actor, Tier-2 to CI/CD chain previously observed.
THREAT ACTOR PROFILE
REDACTED
APT · MAKARA
STATE-ALIGNED · MARITIME CYBER
FIRST OBSERVED Q1 2026
CATALOGUED IN NTRO-IR-2026-05

CAPABILITY MATRIX

Shore-Office Ship-Mgmt Exploit
89
Satcom Trusted-Relationship Abuse
93
ECDIS Chart-Update Tamper (S-63)
86
AIS AIVDM Ghost-Contact Spoof
74
GPS Receiver Firmware Exploit
68

OBSERVED TTPs · MITRE ATT&CK + ICS

INITIALT1190 Public-Facing App INITIALT1199 Trusted Relationship LATERALT1021.004 SSH CREDT1078.002 Domain Account IMPACTT1565.001 ECDIS Tamper IMPACTT1565.001 AIS Spoof IMPACTT1565.001 GPS Spoof ICST0832 Manipulation of View ICST0820 Engine-OT (FAIL)
ICG STATION AURORA · COASTAL RADAR CHAIN + NC3I OVERLAY
INMARSAT FBB MV SAGAR-VARUN · IMO 9876543 (FICTIONAL) BRIDGE APT-MAKARA STATE · MARITIME CYBER SHORE OFFICE AMLPL · PortBridge SHIP WIFI ECDIS AIS GPS ENGINE OT IACS UR E27 air-gap MASTER Capt. R. Bhandari CREW Wi-Fi SOLAS V/27 + V/34-1 Paper BA Chart 2738 Sextant · Chronometer 2024 Nautical Almanac Master Overriding Authority NO CYBER PATH MV SAGAR-VARUN · MUMBAI → SINGAPORE CAPE-SIZED BULK CARRIER · BAY OF BENGAL · ANDAMAN SEA TRANSIT (FICTIONAL) T+28 MIN · SEXTANT FIX TAKEN
SHIP I&C NODE ENGINE-OT PROBE BLOCKED HOSTILE / ATTACK FLOW SOLAS V/27 · DEFENCE-IN-DEPTH
MISSION OBJECTIVES
01
Detect shore PortBridge SQL-injection
Force shore-to-ship Wi-Fi credential rotation + WAF block-mode on /vtms/voyage-docket
T+10 min
02
Quarantine ship Wi-Fi on satcom anomaly
Apply VLAN ACL to isolate Wi-Fi from IBS; start ISPS 30-min clock; NTRO IOC correlation
T+12 min
03
Paper BA Chart 2738 cross-check vs ECDIS
SOLAS V/27.2 paper-chart layer detects the 0.4 nm shipping-lane spoof
T+22 min
04
Sextant celestial position fix
Master + 2nd Officer Polaris + Venus 21:30 local; defence-in-depth punchline
T+30 min
05
Master invokes SOLAS V/34-1
Manual navigation by paper chart + sextant; bridge log declaration
T+30 min
06
File 5-clock regulatory submissions
ISPS 30m + DPA 1h + DGShipping + CERT-In + NCIIPC 6h + IMO MSC.428 24h
T+30 m / T+24 h
RULES OF ENGAGEMENT

PERMITTED

  • All actions within exercise subnet 10.50.0.0/16
  • Defensive WAF rules, AD revocation, ship Wi-Fi VLAN ACL
  • Forensic collection from any in-scope shore + ship host (hash-first discipline)
  • Paper-chart + sextant cross-checks (no cyber dependency)
  • Master's SOLAS V/34-1 overriding authority invocation

PROHIBITED

  • Any interaction with paper-chart / sextant / celestial-navigation calculations (no cyber path by design)
  • Any successful engine-OT compromise — IACS UR E27 air-gap holds by design
  • Out-of-band channels — personal phone, public email, social
  • Persistent backdoors, exfiltration to non-exercise endpoints
  • Unilateral DGShipping or IMO MSC.428 filings without DPA concurrence
REGULATORY CLOCKS · MARITIME + INDIA
30m
IMMEDIATE
ISPS
SSO immediate
brief
1h
ADVISORY
DPA
ISM Code
Master→Owner
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
24h
IR PACK
IMO MSC.428
Maritime Cyber
Risk Mgmt
MISSION LIVE IN
3
…