Nation-state APT on citizen services

The threat

A patient, well-resourced adversary is discovered inside citizen-facing systems. Attribution is sensitive, transparency expectations are high, and every disclosure decision has political weight.

Key injects

• 01Threat intel attributes the intrusion to a state-linked group.
• 02A minister's office asks for a public statement now.
• 03Another agency shares an overlapping indicator.
• 04A leaked document forces the disclosure timeline forward.

What's assessed

• Attribution handling and classification discipline
• Inter-agency coordination under pressure
• Transparency vs. operational-security balance
• Political-stakeholder management

Exercise objectives

• Choose between watching the adversary and immediate eviction, with the trade-off argued and recorded.
• Keep every public statement inside assessed attribution confidence: no name without evidence.
• Coordinate with partner agencies and the national CSIRT despite classification constraints.
• Take the disclosure decision deliberately, before a leak takes it for you.

Roles at the table

• ●Crisis team lead · Runs the response across security, service owners and the political level; guards need-to-know.
• ●SOC / threat intelligence · Tracks the actor, assesses attribution confidence, plans eviction without tipping them off.
• ●Citizen-services owner · Speaks for the affected services: what stays online, what must be degraded, what citizens see.
• ●Communications / press office · Public and ministerial lines; keeps trust without overclaiming certainty.
• ●Legal · Disclosure duties, classification rules and inter-agency data-sharing agreements.
• ●Agency leadership · Owns the political interface and the final disclosure call.

Discussion prompts

• 01Watch the adversary and learn, or evict now and lose the intelligence? Who decides, and against which criteria?
• 02Threat intel says 'state-linked, moderate confidence'. The minister's office wants a name today. What do you give them?
• 03Another agency's indicators overlap with yours. How much do you share when your own case is classified?
• 04A leaked document moves disclosure forward by a week. Did your plan survive first contact, and what replaces it?
• 05Citizens cannot tell whether their data is affected. What does the service portal say on day one?
• 06Which damages public trust more: a week of silence, or correcting your own statement twice in two days?

Suggested timeline

• 00:00–00:30Quiet discovery: scope the intrusion without tipping off the actor
• 00:30–01:15Containment strategy: watch vs. evict; need-to-know defined
• 01:15–02:00Inter-agency coordination and attribution discipline
• 02:00–02:40Disclosure under pressure: leak response, ministerial and public lines
• 02:40–03:00Hot wash: decision trail, trust impact, hardening priorities