INDUSTRY FACT FILE · DEFENCE & STRATEGIC INDUSTRIES

Five New Case Studies in Defence and Strategic Industry Security

Original 2026 case studies, each written as a blog post, showing how current threats play out at defence suppliers, PSUs, private manufacturers, start-ups and strategic electronics firms, and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Drawing That Left Through a Supplier 3.  Case Study 2: The Directive That Was Not From Headquarters 4.  Case Study 3: The Night the Shop Floor Stopped 5.  Case Study 4: The Firmware Update Nobody Signed 6.  Case Study 5: The Stick That Crossed the Air Gap

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining control failures widely observed in manufacturing, technology and defence-related organisations with the obligations that apply in India as of October 2026—in particular SMLDI 2025, CERT-In's Directions and 2025 audit policy, NCIIPC duties for protected systems, the Official Secrets Act and the partner and contract terms under which defence work is done. Attack techniques are described only at the level needed to explain the controls; no operational detail is given.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Drawing That Left Through a Supplier	MSME machining supplier	Supplier compromise and long-term data theft	Contracts; SMLDI; CERT-In; partner terms	B9, B7, B8
2. The Directive That Was Not From Headquarters	Defence PSU	Spear-phishing and state-linked espionage	CERT-In; SMLDI; Official Secrets Act	B7, B10, B8
3. The Night the Shop Floor Stopped	Private defence manufacturer	Ransomware spreading from IT into production	CERT-In; SMLDI; SEBI LODR; contracts	B3, B7, B8
4. The Firmware Update Nobody Signed	Defence start-up	Build pipeline compromise and firmware tampering	Contracts; iDEX terms; CERT-In	B2, B9, B11
5. The Stick That Crossed the Air Gap	Strategic electronics firm	Removable media bridging an isolated design network	SMLDI; Official Secrets Act; CERT-In	B3, B1, B8

The prime had protected its own network for years. The drawings were sitting on a supplier's file server.

At a glance
Organisation	A precision machining MSME (“Machco A”) supplying sub-assemblies for several programmes to a private defence prime
Threat	A stolen email password, no MFA and an internet-exposed file server let attackers copy customer drawings for months
Why it is new	Indigenisation puts controlled drawings in small firms that have never been assessed
Codec Networks services	Supplier assurance, managed SOC, forensics (Bundles B9, B7, B8)

The scenario

Machco A received drawings and specifications from its customer by email and stored them on a file server that staff could reach from home. Its mailboxes had no MFA, the file server was exposed to the internet for convenience, and nobody monitored either. The prime's supplier questionnaire had been answered once, three years earlier.

Attackers obtained a staff member's email password, read correspondence with the prime and used the same credentials on the file server. Over several months they copied drawings for sub-assemblies on three programmes in small batches that raised no alarm.

The prime's own monitoring eventually noticed sign-ins to a shared project mailbox from unfamiliar locations and asked Machco A to investigate. Forensics confirmed the theft. The prime suspended new work orders, assessed which programmes were affected, reported the incident and began a review of every supplier holding controlled drawings.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Drawings sent by email and stored on an internet-exposed file server.
• No MFA on mailboxes or remote access.
• No monitoring of data transfers at the supplier.
• A one-off questionnaire instead of risk-based supplier assessment.

The impact

Machco A lost new orders and faced months of remediation; the prime reassessed affected programmes, informed its customers as its contracts required and launched a tiered supplier assurance programme.

The regulatory lens

• Contracts and partner terms: data handling, incident reporting and right-to-audit clauses invoked by the prime.
• CERT-In Directions: the incident reported within six hours of noticing it; logs needed for the investigation.
• SMLDI 2025: classified and controlled information handled under the data classification and security requirements that apply to the licensed prime.

How Codec Networks would help

Need	Codec Networks response	Bundle
Know the suppliers	Tiered supplier assessments, secure drawing exchange and enforceable contract clauses	B9
Watch the transfers	Managed SOC alerts on unusual sign-ins and bulk downloads at supplier and prime	B7
Scope the loss	Forensic investigation, affected-data analysis and reporting support	B8

Key lessons Never send controlled drawings by plain email. Require MFA at every supplier holding drawings. Assess suppliers by risk, not by questionnaire. Monitor data leaving suppliers as well as the prime.

The document looked like every directive the engineers had ever received. The sending domain did not.

At a glance
Organisation	A defence public-sector undertaking (“Defco B”) with design, production and office networks across several sites
Threat	A decoy 'directive' from a lookalike domain installed a remote-access implant on an internet-facing laptop that held project papers it should not have held
Why it is new	Espionage groups imitate official correspondence because staff are expected to act on it
Codec Networks services	SOC threat hunting, phishing simulation, compromise assessment and forensics (Bundles B7, B10, B8)

The scenario

Engineers at Defco B received an email presented as a headquarters directive on programme reviews, sent from a domain that closely resembled an official one. The attachment asked the reader to enable content to view a table. One engineer opened it on an internet-facing office laptop.

A remote-access implant was installed. Over the following weeks the attackers collected email credentials and copied project papers that had been kept on the office network for convenience, although Defco B's policy said such work belonged on the isolated design network.

CERT-In alerted Defco B that one of its addresses was communicating with a known malicious server. A compromise assessment, carried out under Defco B's security procedures, found the implant on several machines. The isolated design network showed no sign of compromise, but the papers on the office network had to be treated as lost.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No lookalike-domain blocking or strict email authentication checks.
• Macros allowed in documents from the internet.
• Official papers kept on an internet-facing network against policy.
• No threat hunting for beaconing or slow exfiltration.

The impact

Defco B assessed the damage to affected programmes with its ministry, briefed its leadership, tightened enforcement of its isolation policy and rebuilt its email and endpoint defences.

The regulatory lens

• CERT-In Directions: incident reported within six hours of noticing it; logs needed for the investigation.
• SMLDI 2025: official work on air-gapped networks, data classification and event-based reporting.
• Official Secrets Act: potential exposure of classified information handled through the appropriate authorities.

How Codec Networks would help

Need	Codec Networks response	Bundle
Hunt the intruder	SOC threat hunting for beaconing, credential misuse and exfiltration	B7
Train the target	Spear-phishing simulation with realistic directive and posting lures	B10
Scope the loss	Compromise assessment and forensics under clearance procedures	B8

Key lessons Keep official work off internet-facing systems. Block lookalike domains and macros from the internet. Hunt for quiet beaconing, not just alerts. Assume someone else may spot you first.

The VPN had been set up during a rush order. Nobody had added MFA afterwards.

At a glance
Organisation	A listed private manufacturer (“Armco C”) producing vehicle and weapon sub-systems for DPSUs and export customers
Threat	A VPN account without MFA let ransomware operators in; a flat network let them reach MES servers and machining cells
Why it is new	Delivery deadlines make defence manufacturers attractive ransomware targets
Codec Networks services	IT–OT segmentation and remote-access hardening, managed SOC, ransomware response (Bundles B3, B7, B8)

The scenario

Armco C ran ERP, engineering workstations, its manufacturing execution system and networked CNC cells on one flat network. A VPN account created for a contractor during a rush order had a simple password and no MFA, and it was never removed.

Ransomware operators used the account, moved from the office network to the MES servers and, over a weekend, deleted online backups and encrypted servers across IT and the shop floor. Machining cells stopped because they could not receive programs or report quality data.

Armco C reported to CERT-In, engaged forensics and rebuilt systems from older offline copies. Delivery milestones slipped by several weeks, a leak site published commercial files with a ransom demand, and customers asked for evidence that no controlled designs had been taken.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• A forgotten VPN account without MFA.
• A flat network joining office IT, MES and CNC cells.
• Online backups deletable by the same administrator account.
• No 24x7 monitoring to catch weekend activity.

The impact

Armco C lost weeks of production, faced delivery penalties and customer scrutiny, disclosed the incident as a listed company and rebuilt its network with IT–OT zoning, remote-access controls and monitoring.

The regulatory lens

• CERT-In Directions: incident reported within six hours of noticing it; 180-day logs needed.
• SMLDI 2025: cyber controls, SCADA and industrial system policies and event-based reporting for the licensed manufacturer.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report; customer contracts invoked for delivery delays.

How Codec Networks would help

Need	Codec Networks response	Bundle
Zone the plant	IT–OT segmentation, remote access only through MFA and jump hosts	B3
Watch the weekend	EDR and 24x7 SOC alerts on lateral movement, backup deletion and encryption	B7
Recover and explain	Ransomware response, forensics and evidence for customers and CERT-In	B8

Key lessons Remove temporary accounts when the job ends. Separate office IT from the shop floor. Keep offline backups of MES and machine programs. Monitor nights and weekends, not office hours.

The code was reviewed. The build server that turned it into firmware was not.

At a glance
Organisation	An iDEX-funded drone start-up (“Droneco D”) delivering trial units to a defence customer
Threat	A contractor's build-pipeline token exposed in a public repository allowed an unknown party to alter a build script before a release
Why it is new	Software-defined systems move risk from the factory into the build pipeline
Codec Networks services	Secure SDLC and firmware assurance, supplier assurance, AI and autonomy risk review (Bundles B2, B9, B11)

The scenario

Droneco D built its flight-control firmware on a shared cloud build service. A contractor helping with test automation committed a configuration file containing a build-pipeline token to a public repository. Firmware images were not signed, and the drones did not verify firmware before loading it.

Someone used the token to change a build script so that a modified component was pulled into the next release. Code review saw nothing unusual, because the source code itself had not changed. The release went to trial units.

During trials, several units behaved unexpectedly and the trial was halted. Investigation found the altered build script. Droneco D had to prove to its customer which units were affected, rebuild and re-verify every image and explain how it would prevent a repeat.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• A secret exposed in a public repository and never rotated.
• An unprotected build pipeline outside code review.
• Unsigned firmware with no verification on the device.
• No SBOM or component provenance for releases.

The impact

Droneco D lost months of trial time, faced close customer scrutiny of its development practices and rebuilt its pipeline with signing, secret scanning, least-privilege tokens and an SBOM for every release.

The regulatory lens

• Customer contracts and iDEX agreements: quality, security and reporting expectations for delivered prototypes.
• CERT-In Directions: a compromise of the build system reported within six hours of noticing it.
• SMLDI 2025: applies if the start-up holds an industrial licence for the item, including data classification and cyber controls.

How Codec Networks would help

Need	Codec Networks response	Bundle
Secure the pipeline	Secure SDLC, build pipeline review, code signing and verified boot	B2
Check the contractors	Contractor access, secret handling and component provenance reviews	B9
Assure the autonomy	Risk review of autonomy and AI components and their update paths	B11

Key lessons Scan for secrets and rotate them immediately. Protect the build pipeline as well as the code. Sign firmware and verify it on the device. Keep an SBOM for every release.

The design network had no internet connection. It did have a drawer full of USB drives.

At a glance
Organisation	A strategic electronics manufacturer (“Labco E”) designing radar and communications modules on an isolated design network
Threat	Informal transfers on personal USB drives carried malware from a home computer into the isolated network, where design files were staged for removal
Why it is new	Air gaps fail at the point where people move data across them
Codec Networks services	Air-gap and transfer architecture, restricted environment assessment, forensics (Bundles B3, B1, B8)

The scenario

Labco E kept its design work on an isolated network, as its security plan required. To move test files between the lab and office networks, engineers had fallen into the habit of using personal USB drives, because the approved transfer process was slow.

One drive had been used on a home computer infected with malware. When it was connected to a design workstation, the malware copied itself and began collecting design files in a hidden folder, ready to be carried out on the next transfer.

A newly introduced routine scan of removable media at the lab door detected the malware before any data left. A forensic investigation under Labco E's security procedures confirmed that the staged files had not left the building, and the company redesigned how data crossed its air gap.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Personal, unregistered USB drives used for transfers.
• A slow approved process that staff worked around.
• No scanning or logging of transfers until recently.
• Little monitoring inside the isolated network.

The impact

Labco E avoided a loss of design data but spent weeks investigating, cleaning and re-verifying workstations, and replaced informal transfers with a fast, controlled and logged process.

The regulatory lens

• SMLDI 2025: official work on air-gapped networks, data classification and controlled handling of classified information.
• Official Secrets Act: protection of classified design information and need-to-know handling.
• CERT-In Directions: the malware incident reported within six hours of noticing it.

How Codec Networks would help

Need	Codec Networks response	Bundle
Design the crossing	Controlled transfer through a scanning kiosk, registered and encrypted media only	B3
Test the isolation	Restricted environment assessment under clearance procedures	B1
Confirm the outcome	Forensic investigation of affected workstations and media	B8

Key lessons Make the approved transfer process fast enough to use. Allow only registered, encrypted media. Scan and log every transfer. Monitor inside the air gap, not just at its edge.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com