Human-to-machine (H2M) communication is an important evolution in the industrial internet of health things (IIoHT), where many H2M interfaces are remotely interacting with industrial and medical assets. Lightweight protocols, such as constrained application protocol (CoAP), have been widely utilised in transferring sensing data of medical devices to end-users in smart satellite-based healthcare IIoT networks (SmartSat-IIoHT). However, such protocols are extensively deployed without appropriate security configurations, making attackers' mission easier for abusing these protocols to launch advanced cyber threats. This paper, therefore, presents a new threat intelligence framework to examine and model CoAP protocol's attacks in these systems. We present a ransom denial of service (RDoS) as a new threat that would exploit this protocol's vulnerabilities. We propose many RDoS attack's techniques to understand the attack indicators and analyse their behaviour on systems. Moreover, we present a real-time discovery of attacks' network behaviours using deep learning. The experiment results demonstrate that this proposed discovery model obtains a better performance in revealing RDoS than other conventional machine learning algorithms and accomplishing high fidelity of protecting SmartSat-IIoHT networks.