CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · ONE · SEVEN · BRIEFING BEGINS
OPERATION DESIGNATOR
OPERATION CODENAME
OPERATION VAJRA STORM
AREA OF OPERATIONS · GRID 47Q LU 2814 5673
SITUATION REPORT
H-12 RF spectrum monitoring detects sustained directional jamming on tactical VHF + L-band data links.
H-08 UAV-GCS reports GPS position spoofing on inbound ISR feed. Track drift exceeds tolerance.
H-04 FOB-HQ network intrusion confirmed via supply-chain compromise. Lateral movement to relay tier.
H+0 Concurrent escalation: SIGINT post DoS, attempted credential dump on UAV-GCS.
Attribution: OPFOR callsign TANGENT-9 — peer-tier EW + cyber actor.
THREAT ACTOR PROFILE
TANGENT-9
PEER-TIER · EW + CYBER
FIRST OBSERVED EXERCISE Q1 2026
DOCTRINE DCyA-OPFOR-04
DOCTRINE DCyA-OPFOR-04
CAPABILITY MATRIX
OBSERVED TTPs · MITRE ATT&CK
EWRF Spectrum Jamming
EWGNSS Spoofing
INITIALT1195 Supply Chain
CREDT1003.001 LSASS
CREDT1558.003 Kerberoast
LATERALT1021.002 SMB
IMPACTT1498 Network DoS
BLUE FORCE C2 NET · TAC NET
MISSION OBJECTIVES
01
Maintain commander uplink
Keep FOB-HQ to Higher-HQ secure-radio path open; fall back to RELAY-2 SATCOM if RELAY-1 stays jammed
H+15 min
02
Restore RF spectrum
Locate jamming source, vector to SIGINT, request EW counter-tasking from Air HQ joint cell
H+30 min
03
Detect & contain network intrusion
Isolate compromised hosts at switchport; rotate Kerberoasted service-account credentials; revoke TGTs
H+45 min
04
File DCyA incident report
Defence Cyber Agency 24-hour forensic timeline; CERT-In + NCIIPC notifications in parallel
H+24 h
RULES OF ENGAGEMENT
PERMITTED
- Live execution within TAC NET (10.10.0.0/16) — no mocks
- RF spectrum sensing, direction-finding, EW counter-tasking via Air HQ joint cell
- Voice-radio fallback at any time — mission continues on voice if cyber link is degraded
- Force composition: 12 BLUE · 6 RED · 4 WHITE CELL · 90-minute window
PROHIBITED
- Internet DARK — no outbound to public networks for the full TOT
- Live ammunition or kinetic effects of any kind
- Real friendly-force unit identifiers — use exercise call-signs only
- Disclosure of exercise content outside cleared DCyA-briefed personnel
REGULATORY CLOCKS · DEFENCE
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
Annexure-I(B)
6h
NOTIFY
NCIIPC
CII operators
IT Act Section 70 framework
IT Act Section 70 framework
24h
FORENSIC
DCyA
Defence Cyber Agency
operational timeline
operational timeline
6h
BRIEF
MoD CYBER
Ministerial cell
Higher-HQ brief
Higher-HQ brief
MISSION LIVE IN
3