CLASSIFIED // FOR EXERCISE USE OP CODE VYOM-DRISHTI
ICAO 9985 ICAO 4444 PANS DGCA CRS 2022 BCAS cyber EUROCAE ED-205 CERT-In 6h
T+00:00:00
CLASSIFIED
MISSION BRIEFING
AUTHORIZATION ALPHA · NINE · ZERO  ·  BRIEFING BEGINS
OPERATION DESIGNATOR
NATIONAL CYBER EXERCISE DIRECTORATE CIVIL AVIATION ATC · 2026
OPERATION CODENAME
OPERATION VYOM-DRISHTI
INITIATED 02:00 IST 17 MAY 2026 WINDOW T+0 → T+24h AURORA INTL · VAAU/AUR (FICT)
ALL ORGANISATIONS, PERSONNEL, AIRPORT NAMES FICTIONAL · AURORA INTL, AAI ATM AURORA, AY9 CALLSIGNS · REGULATORY REFERENCES (ICAO DOC 9985 · ICAO DOC 4444 PANS-ATM · ICAO ANNEX 11/17 · DGCA CRS 2022 · BCAS · EUROCAE ED-205 · CERT-IN · NCIIPC) REAL
AURORA INTL AIRPORT · APPROACH + TERMINAL AREA (FICTIONAL) ICG AURORA NC3I · CRS-7 RADAR · 60 nm PORT ANUJA AIS-3 AIS-4 GHOST FLEET 21°45N 87°30E ROCKET-1 · MPA DEFENCE-IN-DEPTH AURORA-CITY N 50 KM
SITUATION REPORT
02:00 AAI ATM web portal WAF flags SQL-injection probes against /atm/operations; aftn_admin_credentials read attempt detected.
02:10 Tower receives NOTAM A1234/26 declaring 09L closed 02:30-06:30 IST — AAI AIS origination chain has NO record of this NOTAM.
02:18 Approach scope shows 3 ADS-B ghost contacts (AY9999, IX1234, AI8888) with NO corresponding PSR skin-paint return.
02:24 METAR feed shows visibility 1500 m — tower visual confirms CAVOK (>10 km) actual.
02:29 Watch Supervisor invokes ICAO Doc 4444 Ch 12 procedural control — voice + paper flight strips active.
Attribution preliminary: APT-PAVAN — state-aligned aviation cyber actor, AAI ATM portal to ADS-B chain previously observed.
THREAT ACTOR PROFILE
REDACTED
APT · PAVAN
STATE-ALIGNED · AVIATION CYBER
FIRST OBSERVED Q1 2026
CATALOGUED IN NTRO-IR-2026-06

CAPABILITY MATRIX

AAI ATM Portal Exploitation
89
AFTN Trusted-Relationship Abuse
93
AMHS NOTAM Injection
86
ADS-B Ghost-Aircraft Injection
74
METAR + AOC Tamper Attempts
68

OBSERVED TTPs · MITRE ATT&CK + ICS

INITIALT1190 AAI ATM Portal LATERALT1021.002 SMB LATERALT1199 AFTN Trust CREDT1078.002 Admin Account IMPACTT1565.001 NOTAM Injection IMPACTT1565.001 ADS-B Spoof IMPACTT1565.001 METAR Tamper ICST0832 Manipulation of View ICST0815 Denial of View
ICG STATION AURORA · COASTAL RADAR CHAIN + NC3I OVERLAY
09L 27R RWY 09L/27R · 3,500 m × 60 m CONTROL TOWER AIA · VAAU (fictional) TERMINAL · AURORA INTL PSR DOME N AY9001 · 120 IX0214 · 090 AY9999 · 150 ⚠ IX1234 · 280 ⚠ AI8888 · 350 ⚠ APPROACH SCOPE · 60 nm AY9001 B737 · VT-AYA · INBOUND APT-PAVAN STATE · AVIATION CYBER AAI ATM web portal AFTN AMHS ADS-B GND METAR PSR · INDEPENDENT Hardware-tapped skin-paint Ghost contacts have NO PSR DGCA CAR Section 3-C-I WATCH SUP V.SUBRAMANIAN AOC AY9 ICAO DOC 4444 CH 12 Voice · Paper strips · Visual Time + altitude separation NO CYBER PATH AURORA INTL · VAAU · AAI ATM TOWER CIVIL AVIATION ATC · TIER-2 INDIAN AIRPORT (FICTIONAL) T+29 MIN · PROCEDURAL CONTROL ACTIVE
ATC NODE ADS-B GHOST CONTACT HOSTILE / ATTACK FLOW PSR + ICAO 4444 · DEFENCE-IN-DEPTH
MISSION OBJECTIVES
01
Detect AAI ATM SQL-injection
WAF block + AFTN admin rotation; AAI ATM Watch Supervisor 15-min clock starts
T+5 min
02
Voice-verify fake NOTAM with AAI AIS
NOTAM A1234/26 absent from AIS origination chain; reverse + broadcast retraction
T+12 min
03
PSR cross-check vs ADS-B ghost contacts
Independent Primary Surveillance Radar catches 3 ghost callsigns; voice-confirm real traffic
T+20 min
04
Invoke ICAO Doc 4444 procedural control
Paper flight strips + voice position reports + 10-min time + 1000-ft vertical separation
T+29 min
05
Verify AOC Aurora Airlines FPL integrity
Voice-confirm AY9001/9007/9015 against AOC baseline + pilot position reports
T+40 min
06
File 6-clock regulatory submissions
AAI 15 m + DGCA 30 m + BCAS 1 h + CERT-In + NCIIPC 6 h + ICAO MID 24 h
T+15 m / T+24 h
RULES OF ENGAGEMENT

PERMITTED

  • All actions within exercise subnet 10.50.0.0/16
  • Defensive WAF rules, AFTN admin rotation, AMHS audit pulls
  • Forensic collection from any in-scope ATM/AOC host (hash-first discipline)
  • PSR + voice + visual + paper-strip cross-checks (no cyber dependency)
  • Watch Supervisor ICAO Doc 4444 procedural-control invocation

PROHIBITED

  • Any interaction with PSR feed via cyber means (hardware-tapped by design)
  • Any interaction with VHF voice radio (independent channel; no cyber path)
  • Out-of-band channels — personal phone, public email, social
  • Persistent backdoors, exfiltration to non-exercise endpoints
  • Unilateral DGCA, BCAS, or ICAO MID filings without DGCA Liaison concurrence
REGULATORY CLOCKS · AVIATION + INDIA
15m
IMMEDIATE
AAI WATCH
15-min
immediate brief
30m
BRIEF
DGCA
CRS 2022
brief 30m
6h
REPORT
CERT-IN
Directions 2022
Annexure-I(B)
24h
IR PACK
ICAO MID
Doc 9985
Annex 17
MISSION LIVE IN
3
…