Fictional training scenario — not real intelligence

Practical exercise

Dry Season

AdvancedStrategic & cyber threat~45 min7 reports

Tasking

Requested by: Director, Critical Infrastructure Resilience, New Arden Department of Home Security
Key question: Who is most likely behind the intrusions at the three utilities, and what is the outlook for the next six months?
Deadline: Ministerial brief due Friday 1700. The minister reads the first paragraph only.

Over five weeks, intruders got into the remote pump-station management systems of three regional water utilities in the state of New Arden. Nobody lost water, but at one site a treatment setpoint was changed and reverted by an operator within minutes. The intrusions come as New Arden negotiates the Tarrant Corridor agreement — a contentious water-and-mining deal opposed by local activists and by the neighbouring Republic of Velantia, which says it threatens its own river supply. Ministers are hearing different stories from different people. The Department of Home Security wants one assessment.

Brief pack · 7 reports

Regulator's consolidated incident report

Issued 12 Sep (covers 4 Aug – 9 Sep)

Official record: New Arden Water Regulator, compiled from mandatory incident notifications. Each utility reported its own incident.

Ardmore Valley Water (4 Aug), Brennick Water (19 Aug) and Calloway Shire Water (9 Sep) each detected unauthorised log-ins to StationView Remote, the product all three use to manage pump stations remotely. At Ardmore and Brennick the intruders viewed screens and downloaded configuration files but changed nothing. At Calloway a disinfection setpoint was altered; an operator noticed within six minutes and reverted it. No effect on water quality. All three were running a StationView version without the security update released in May. No ransom demand or extortion contact has been reported by any of the three utilities.

Vendor security advisory

15 Sep

Interested party: StationView Software, the product's vendor. Its advisories are usually accurate on technical detail, but it has commercial and legal reasons to minimise its own role.

"A vulnerability affecting StationView Remote versions earlier than 6.4 allows authentication bypass. A fix was released on 14 May and customers were notified. We have no evidence that StationView's own systems were compromised. The incidents in New Arden involved unpatched installations." The advisory does not say how many customers remain unpatched.

Commercial threat intelligence blog

18 Sep

Open source (commercial): Public blog post by Brightmoor Threat Intelligence, a private security company. Its technical analysis is usually sound; one of its four previous attributions in this region was later withdrawn.

Brightmoor attributes the intrusions to GRAPHITE LYNX, a group it assesses works for Velantian intelligence. Evidence cited: (1) two IP addresses used against Brennick were used by GRAPHITE LYNX in a 2024 campaign; (2) a script fragment found at Ardmore resembles code from that campaign. Brightmoor does not say whether the IP addresses belong to a hosting provider shared with other customers. Brightmoor sells GRAPHITE LYNX detection rules to utilities.

Hacktivist claim of responsibility

21 Sep

Self-claimed actor: Public post on the channel of the Dry Rivers Collective, a protest group opposed to the Tarrant Corridor agreement. Of its three previous hacking claims, one was verified and two were false.

"We took New Arden's water — Ardmore, Brennick, Calloway. Next time the taps go dry. Kill the Corridor deal." The post includes a screenshot of a pump-station control screen. Brennick Water has confirmed the screenshot is genuine and matches the screen the intruders viewed on 19 Aug. Nothing in the post relates to Ardmore or Calloway beyond their names, which were reported in the media on 16 Sep.

Partner liaison report

17 Sep

Partner intelligence: Report passed by an allied government's intelligence service through official liaison. The partner is usually reliable; it does not share its sources.

"We assess with moderate confidence that Velantian intelligence has been tasked since early this year to prepare options to put pressure on countries pursuing the Tarrant Corridor agreement, including options against critical infrastructure. We have no information linking this tasking to specific incidents in New Arden."

National cyber response centre technical note

20 Sep

Official technical: New Arden Cyber Response Centre (NACRC), from its forensic work at Calloway Shire Water and its own monitoring of criminal forums.

The tool found at Calloway is a commodity remote-access program sold on criminal forums since 2023. Its command-and-control servers are rented from a 'bulletproof' hosting provider widely used by ransomware affiliates — the same provider that hosts the IP addresses Brightmoor links to GRAPHITE LYNX (R3). On 21 Jul, two weeks before the first intrusion, a seller on a criminal access-broker forum advertised "remote access, 3 x water utilities, New Arden, StationView, $9,000". The listing was marked sold on 28 Jul. NACRC cannot see who bought it.

National newspaper report

22 Sep

Open source (media): The Arden Herald, a mainstream national newspaper with a good accuracy record. The article quotes an unnamed 'senior government official'.

"A senior government official said the attacks had 'all the hallmarks of Velantia' and that intelligence agencies were 'increasingly confident' of Velantian involvement. The official cited 'private sector analysis and partner reporting'."

Brief pack (7 reports)