INDUSTRY FACT FILE · METALS, MINING & CEMENT

Five New Case Studies in Metals, Mining and Cement Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in mining groups, metal producers, smelters and cement manufacturers and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Kiln That Kept Turning While Nothing Left the Gate 3.  Case Study 2: The Remote Operations Centre With One Password 4.  Case Study 3: The Furnace Vendor's Laptop 5.  Case Study 4: The Weighbridge That Rounded Up 6.  Case Study 5: The Smelter's Captive Power Plant

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in metals, mining and cement with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, NCIIPC for notified systems, SEBI disclosure for listed companies, DGMS and mining statutes, DPDP and the buyer and export requirements that reach Indian producers.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Kiln That Kept Turning While Nothing Left the Gate	Cement manufacturer	Ransomware encrypting ERP and dispatch	CERT-In; SEBI LODR; insurers	B3, B7, B8
2. The Remote Operations Centre With One Password	Iron ore mining company	Contractor account abuse reaching fleet systems	CERT-In; OSH Code and DGMS; MDO contract	B9, B3, B1
3. The Furnace Vendor's Laptop	Integrated steel plant	Malware introduced by OEM engineering device	CERT-In; IEC 62443; OEM contract	B9, B1, B7
4. The Weighbridge That Rounded Up	Mineral mining and dispatch operation	Insider manipulation of dispatch data	MMDR and state rules; CERT-In; forensics	B2, B7, B8
5. The Smelter's Captive Power Plant	Aluminium smelter	Corporate credentials reaching power plant control	CERT-In; IEC 62443; SEBI LODR	B3, B1, B10

Every kiln ran at full rate. For four days, not one truck passed the gate.

At a glance
Organisation	A listed cement group (“Cemco A”) with five integrated plants, three grinding units and forty depots on one ERP
Threat	Phishing leading to domain compromise and ransomware across ERP, dispatch, weighbridge and depot systems
Why it is new	Cement revenue depends on dispatch, and dispatch depends entirely on IT
Codec Networks services	Segmentation and backups, SOC, forensics (Bundles B3, B7, B8)

The scenario

A phishing email gave attackers a foothold in Cemco A's corporate network. Over three weeks they escalated to domain administrator unnoticed—EDR alerts were raised but nobody watched them at night or on plant holidays.

On a Saturday, ransomware encrypted ERP, the dispatch application, the weighbridge servers at every plant and the backup server, which sat on the same domain. Kilns and mills, controlled by segregated DCS, kept running.

Without invoices, gate passes or weighbridge tickets, no truck could leave lawfully. Yards and silos filled within two days, plants cut clinker output, dealers ran dry in peak season and the group ran dispatch on paper for a week while systems were rebuilt.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Backups were online and domain-joined, so they were encrypted too.
• Dispatch depended entirely on IT with no tested manual plan.
• EDR alerts were not monitored 24x7.
• No restart sequence for ERP, dispatch and weighbridge integration.

The impact

Cemco A lost four days of dispatch and a week of normal sales, cut kiln output, paid recovery costs, disclosed the incident under SEBI LODR and faced insurer questions about backup warranties.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.
• Insurers: policy conditions on backups and MFA scrutinised.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	IT/OT segmentation, immutable backups, tested ERP, dispatch and weighbridge restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Investigate and report	Forensics, root cause, CERT-In and disclosure support	B8

Key lessons Keep backups immutable and off the domain. Plan and rehearse lawful manual dispatch. Monitor EDR around the clock, including holidays. Test ERP, dispatch and weighbridge restores together.

The mine was run from a control room two hundred kilometres away. So, for a night, was the attacker.

At a glance
Organisation	A mining company (“Minco B”) running two open-cast iron ore mines from a remote operations centre with an MDO
Threat	Phished shared contractor account used over an unsegmented site link to reach the fleet management server
Why it is new	Remote operations concentrate control and connect many third parties through links built for availability
Codec Networks services	Supply chain programme, segmentation, OT assessment (Bundles B9, B3, B1)

The scenario

Minco B's MDO dispatched haul trucks and excavators from the remote operations centre through a shared account used by a dozen of its staff, with no MFA. One of them was phished.

The attacker logged in to the centre's remote desktop gateway, found the fleet management and dispatch servers on the same flat network as the site link and began editing dispatch assignments and deleting shift data.

Operators noticed trucks being sent to the wrong loading points and halted the fleet as a precaution. Two shifts of production were lost and a near miss between a haul truck and a light vehicle was reviewed under the mine's safety procedures.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Shared contractor account with no MFA.
• Flat network between the site link, remote desktop gateway and fleet servers.
• No integrity monitoring on fleet and dispatch data.
• No security requirements in the MDO contract.

The impact

Minco B lost two shifts of output, reviewed a safety near miss, reported the incident, re-tendered the MDO contract with security clauses and rebuilt its remote operations network.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• OSH Code and DGMS: safety near miss and shift records reviewed under mine safety procedures.
• MDO contract: no security or incident-notification obligations on the contractor.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control contractor access	Supply chain programme: MDO assessment, named MFA accounts, contract clauses	B9
Isolate remote operations	Segmented remote-ops zone, brokered access, hardened gateway	B3
Verify fleet systems	OT assessment of fleet, dispatch and autonomy systems with integrity monitoring	B1

Key lessons Give every contractor user a named account with MFA. Segment remote-ops links and fleet servers. Monitor fleet and dispatch data integrity. Put security into MDO and contractor contracts.

The attackers never targeted the steelworks. They had already infected the engineer who walked in through the gate.

At a glance
Organisation	A steel producer (“Steelco C”) with an integrated plant and a blast furnace relined during a planned shutdown
Threat	An OEM engineer's laptop carrying malware from another site connected directly to the furnace Level 2 automation network
Why it is new	Shutdowns and turnarounds bring dozens of vendor devices into control networks at once
Codec Networks services	Vendor device programme, OT assessment, OT monitoring (Bundles B9, B1, B7)

The scenario

During a furnace reline, an automation OEM's engineer connected a laptop to the Level 2 network to update furnace models. The laptop had been used at another customer's plant and carried worm-type malware.

The malware spread across HMIs and engineering stations in the furnace area, which shared one network with no internal segmentation, and corrupted several operator stations.

The furnace restarted on schedule but ran on manual procedures with reduced instrumentation for several days while stations were rebuilt. Investigation found no device checks at the gate and no record of which vendor devices had connected where.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No vendor device checks or clean site-owned engineering laptops.
• No segmentation within the furnace automation area.
• No OT monitoring of engineering and vendor activity.
• No security obligations in the OEM service contract.

The impact

Steelco C ran the furnace on manual for several days at reduced output, reported the incident, rebuilt the furnace area network and introduced a vendor device regime for every shutdown.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• IEC 62443: zone-and-conduit and device requirements that the furnace area did not meet.
• OEM contract: no obligations on the vendor's devices and connections.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control vendor devices	Vendor device programme, gate checks, clean laptops, OEM assessment and clauses	B9
Verify the plant	OT assessment of furnace automation, segmentation and change control	B1
Watch engineering activity	OT monitoring of vendor sessions, engineering changes and lateral movement	B7

Key lessons Check and register every vendor device before it connects. Segment within the plant, not just at the edge. Monitor engineering activity during shutdowns. Put device and connection rules into OEM contracts.

No malware, no outage—just a few hundred kilograms that went missing from every truck.

At a glance
Organisation	A mineral producer (“Oreco D”) dispatching iron ore by road and rail from a leased mine
Threat	A dispatch supervisor with administrator rights editing weighbridge tickets and permit quantities after trucks left
Why it is new	Dispatch data is statutory data, and it is usually guarded by access control alone
Codec Networks services	Dispatch system testing, SOC analytics, forensics (Bundles B2, B7, B8)

The scenario

Oreco D's weighbridge software allowed anyone with administrator rights to edit tickets after dispatch. A supervisor held those rights, along with access to the e-permit records and the ERP dispatch module.

Over several months he reduced recorded weights on hundreds of trucks and diverted the difference to an unregistered buyer, while the permit quantities and royalty returns matched the edited tickets.

A reconciliation by the state mining department against rail and port receipts exposed the gap. Oreco D could not initially reconstruct the original weights because logs were overwritten and not retained.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Administrator rights for operational staff on dispatch systems.
• No segregation of duties between weighing, permits and ERP.
• Logs not tamper-evident or retained.
• No analytics comparing weights, permits and receipts.

The impact

Oreco D lost revenue and faced royalty penalties and a lease compliance review, reported the fraud, funded a forensic reconstruction and rebuilt its dispatch controls.

The regulatory lens

• MMDR Act and state rules: royalty returns and e-permit records affected; lease compliance reviewed.
• CERT-In Directions: unauthorised data manipulation reported within six hours of discovery.
• Forensics: reconstruction of dispatch records for the state department and auditors.

How Codec Networks would help

Need	Codec Networks response	Bundle
Harden dispatch systems	Weighbridge, e-permit and ERP dispatch testing; least privilege and segregation of duties	B2
See it happening	SOC analytics on weights, permits and receipts; alerts on post-dispatch edits	B7
Prove it	Forensic readiness and investigation for royalty and audit disputes	B8

Key lessons Remove administrator rights from operational dispatch roles. Make weighbridge and permit logs tamper-evident. Reconcile weights, permits and receipts continuously. Be ready to reconstruct records for regulators.

A potline cannot be switched off. The attackers were one alarm away from switching it off for them.

At a glance
Organisation	A listed aluminium producer (“Alco E”) with a smelter and a captive power plant on one site
Threat	Phished plant engineer's domain account used to reach the captive power plant HMI and alter alarm set-points
Why it is new	Captive power is the smelter's life support and is often reachable from corporate IT
Codec Networks services	Segmentation, OT assessment, tabletop exercises (Bundles B3, B1, B10)

The scenario

Alco E's captive power plant DCS network was reachable from the corporate domain through a jump host that accepted ordinary domain credentials. A plant engineer's account was phished.

The attacker reached the power plant HMI, altered several alarm set-points and attempted to change a protection setting that could have tripped power to a potline—an event that can freeze metal in the cells and take months to recover.

A control room operator noticed the changed alarms, reverted them and raised the alarm. Investigation found the path had existed for years and had never been tested.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Captive power DCS reachable from the corporate domain with ordinary credentials.
• No MFA or privileged access controls on the jump host.
• No OT monitoring of configuration changes.
• No exercise had ever tested the loss-of-power scenario.

The impact

Alco E averted a potline trip, reported the incident, disclosed it as a listed company, segmented the captive power plant and ran its first Board-level tabletop exercise on a cyber-induced power loss.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• IEC 62443: captive power should be a separate zone with controlled conduits.
• SEBI LODR: near-miss incident assessed for disclosure in the quarterly report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate captive power	Segmentation of power plant DCS from corporate IT, MFA and privileged access	B3
Verify the boundary	OT assessment of captive power, substations and jump hosts	B1
Rehearse the worst case	Leadership and plant tabletop exercise on cyber-induced power loss	B10

Key lessons Treat captive power as a critical zone. Require MFA and privileged access for every control network path. Monitor configuration changes on power plant systems. Exercise the loss-of-power scenario with leadership.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com