Operations Playbook - Intelligence Partners
HIGHIndia-specific threat actor tracking, commercial threat intelligence integration (Recorded Future, Mandiant, CrowdStrike, Dragos), STIX/TAXII framework, expert interview network, dark web monitoring, and cooperation gap analysis.
India Threat Actor Portfolio
CRITICALDual-purpose: simultaneous espionage + cybercrime. India operations target pharma, tech, government. Uses legitimate software for lateral movement.
Deliberately impersonates APT41 infrastructure for false-flag. Deploys Ceavesdropping and RazeGate malware via defence-themed spear-phishing.
Crimson RAT and Peppy malware. Expanded beyond security forces to critical infrastructure, telecom, academics. Interests: diplomatic, defence procurement.
ShadowPad malware found in Indian power grid infrastructure (2020-2021). Pre-positioning for potential disruptive operations.
Linked to Pakistani intelligence. Low-and-slow exfiltration, long-dwell intrusions. Modified open-source RATs and custom keyloggers.
EHOLIGE malware family. Kycool C2 infrastructure. Targeting Indian security establishments, northeast India government agencies.
UPI and banking trojans targeting Indian financial institutions.
Cryptocurrency mining botnets affecting Indian enterprise infrastructure.
Active targeting of Indian organizations with LockBit and ALIAS ransomware.
STIX/TAXII Integration Framework
MEDIUMAutomated Feed Integration
India-Specific Alert Thresholds
Tiered model: initial detection triggers monitoring escalation, not immediate alert
Commercial Threat Intelligence Subscriptions
MEDIUMExpert Interview Network
HIGHYear 1 Target: 25-35 active expert relationships across all tiers. Year 2: 50-60 relationships with formal advisory structures. Year 3: 70-90 active relationships with established engagement cadence.
Dark Web Monitoring - India Focus
CRITICALIntelligence Cooperation Gap Analysis
Civil-Military Intelligence Barrier
CRITICALRAW intelligence on PLA did not reach tactical commanders at Galwan 2020
Intelligence-Law Enforcement Chasm
CRITICALRAW and NTRO cyber intel inadmissible in court; no fusion to prosecution
State-Central Information Asymmetry
HIGHState police generate no cyber intel; consumers only of central agency output
DIA-NTRO Technical Competition
HIGHCompeting SIGINT mandates create friction rather than fusion
60+ Day Cross-Border Coordination
HIGHMLAT requests to non-cooperative jurisdictions take 60-180+ days
Quad/Five Eyes Information Shielding
MEDIUMPartners share selectively; India receives processed intel, not raw
India receives finished intelligence products, not raw collection. This reduces attribution confidence and delays operational timing by days to weeks.
Operational Security Requirements
MEDIUMMulti-tenant architecture validated for complete data isolation. Need-to-know access controls.
Compartmentalized storage, encryption at rest/transit. Source codes never in commercial cloud systems.
Segregated IR systems separate from commercial TI platform. Never shared with TI vendors.
Section 43, 66F, 79 boundaries maintained. No unauthorized access to private systems.
Minimize personal data collection. Handle incidental collection (dark web creds) per DPDP principles.
Intelligence Organisation Restriction of Rights Act (1985): Former intelligence officers cannot lawfully disclose specific information about intelligence operations. Official Secrets Act (1923): Collection creating perception of soliciting classified information creates legal risk.
No human network intelligence in systems accessible to commercial TI vendors. Source identities never in client-facing deliverables. Signal for sensitive sources. Encrypted storage minimum AES-256. Dedicated VPN for all network communications.