INDUSTRY FACT FILE · DEFENCE & STRATEGIC INDUSTRIES

Threat Landscape: Top Cyber Threats Facing Defence and Strategic Industries

The 18 most relevant cyber threats, attacks and industry challenges for defence PSUs, private manufacturers, suppliers, research organisations, start-ups and space and electronics firms, and the impact each has.

Defence and strategic organisations face the most capable adversaries in cyberspace because they hold what states most want to know. State-linked espionage groups seek designs, source code, test results, programme schedules and the identities of officers and engineers, usually through spear-phishing that imitates headquarters directives, postings, defence events and current affairs. Ransomware groups attack defence manufacturers as industrial businesses whose delivery deadlines create pressure to pay. Hacktivists deface websites and flood portals during periods of regional tension. Insiders and careless handling of removable media remain among the oldest routes for leaks, and the expanding supplier base means controlled data now sits in many firms that have never been assessed.

Public reporting shows these threats in action, though attribution must be treated with care. Security vendors including Seqrite, Sekoia and CYFIRMA have reported campaigns by the groups known as Transparent Tribe (APT36) and SideCopy against Indian defence and government targets, including lures themed on armed forces directives and the 2025 Pahalgam attack, and fake versions of authentication apps used by officials. During the May 2025 hostilities, Maharashtra Cyber reported more than 1.5 million attacks against Indian systems, of which it said about 150 succeeded. Internationally, LockBit published data it claimed to have taken from Boeing in 2023, Rheinmetall said strict IT separation kept a 2023 ransomware attack away from its military business, and Thales said data published in 2022 came partly from a partner's collaboration-portal account. In India, NPCIL confirmed in 2019 that malware had been found on an administrative network at Kudankulam after a CERT-In alert.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by defence industry segment (Codec Networks assessment).

4.1 State-linked espionage and spear-phishing

Espionage is the defining threat for the sector. Groups reported by security vendors as targeting Indian defence organisations use carefully themed lures, lookalike domains and fake apps, then hold access quietly while documents leave in small amounts. Many intrusions are found by outsiders first, as the Kudankulam case showed when CERT-In alerted the operator. SMLDI 2025's requirement that official work be done on air-gapped networks is designed to break this chain, but only if internet-facing systems hold no controlled data and transfers are controlled.

• Questions to test: Is any controlled or official data held on internet-facing systems? Are email authentication and lookalike-domain controls in place? Are endpoints covered by EDR and is anyone hunting for beaconing and slow exfiltration? Are engineers and officers tested against realistic lures?
• Relevant services: email security review, phishing simulation, EDR and SOC threat hunting, compromise assessment and forensics under the customer's clearance procedures.

4.2 Supplier and tier-2/3 compromise

Indigenisation means drawings and specifications now reach many more firms, many of them MSMEs with no security team, email without MFA and file servers exposed to the internet. An attacker who cannot reach a DPSU directly can often reach its supplier. Thales's statement that a partner's collaboration-portal account was one source of leaked data shows the same weakness at the top of the chain.

• Questions to test: Which suppliers hold which drawings, and how were they sent? Do contracts set security, audit and reporting duties? Have high-risk suppliers been assessed? Are partner accounts protected by MFA, time-limited and monitored?
• Relevant services: tiered supplier assessments, secure data-exchange design, contract clause review, partner access monitoring and supplier incident playbooks.

4.3 Ransomware crossing into production

Ransomware groups attack defence manufacturers for the same reasons they attack any manufacturer: deadlines, penalties and complex estates. When ERP, MES, engineering workstations and CNC cells share a network, encryption spreads to the shop floor and lines stop. Rheinmetall's experience in 2023, where strict separation protected the military business, shows the value of segmentation.

• Questions to test: Are IT, OT, design and isolated networks separated with controlled conduits? Is every remote-access path protected by MFA? Are MES configurations and machine programs backed up offline and restorable? Would the SOC see lateral movement towards the plant?
• Relevant services: OT assessment, IT–OT segmentation review, remote-access review, backup and restore testing, managed SOC and ransomware response.

4.4 Firmware, software and component integrity

Software-defined systems shift risk into code and components. A stolen repository lets adversaries study weaknesses; an exposed build token or tampered dependency can alter firmware; a counterfeit part can fail or behave unexpectedly. Start-ups and electronics firms move fast and often build in the cloud, so build pipeline security, code signing and software bills of materials are essential evidence of integrity.

• Questions to test: Are repositories and build systems protected by MFA and least privilege? Are secrets scanned and rotated? Is firmware signed and verified on boot? Do we keep an SBOM and component provenance for each delivery?
• Relevant services: secure SDLC review, source code and firmware assessment, build pipeline review, SBOM practices and supplier component assurance.

4.5 Insiders, removable media and the air gap

Isolated networks are only as strong as the ways data enters and leaves them. Informal transfers on personal USB drives, unregistered media, shared accounts and weak logging let malware in and let data out, whether by accident or intent. SMLDI 2025 expects data classification, vetted personnel and controlled handling of classified information, and assessments of these environments must follow the customer's security clearance procedures.

• Questions to test: How does data move into and out of isolated networks, and who approves each transfer? Is only registered, encrypted media allowed? Are transfers scanned and logged? Is activity on the isolated network monitored and reviewed?
• Relevant services: restricted environment assessments under clearance procedures, media and transfer control review, insider risk review and forensic investigations.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation; CERT-In may issue directions and advisories.
• SMLDI 2025: event-based reporting to DDP under the manual's reporting framework; security failures can affect licence standing.
• NCIIPC: incidents on notified protected systems handled with NCIIPC guidance and reporting.
• Official Secrets Act: suspected leaks of classified information can lead to investigation by the authorities.
• Partners and US contracts: DFARS 252.204-7012 requires rapid reporting of cyber incidents affecting covered defence information to the US Department of Defense.
• SEBI LODR (listed firms): cyber incidents disclosed in the quarterly corporate governance report; DPDP breach intimation for personal data once provisions commence.

• Which suppliers and partners hold our controlled drawings and code, and how do they protect them?
• Is any official or controlled data held on internet-facing systems, contrary to our isolation policy?
• How does data cross into and out of our isolated networks, and is every transfer logged?
• Could ransomware on our office network reach the shop floor or test benches?
• Can we prove the integrity of the firmware and components we deliver?
• Could we detect, contain and report an incident within six hours, including at night?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from official statements and widely reported events; attributions to named groups are as reported by the security vendors cited.