How COVID-19 changed Cyber Command's 'Cyber Flag' exercise

Even the military's hackers have to work from home.

This year when U.S. Cyber Command convened with allied countries to test how they would collectively defend against a cyber-operation targeting allied networks, the units came together for what appeared to be a straightforward simulation of an attack against a European airbase.

The worldwide coronavirus pandemic made the simulation less than straightforward.

For the first time ever, participants conducted the exercise from home on a new platform, according to U.S. military cyber commanders involved in the exercise. The annual simulation, which simulated an attack that impacted both information technology (IT) and operational technology (OT), took place on the Persistent Cyber Training Environment (PCTE).

“The impact of COVID-19 is pretty clear and it’s been a challenge for us. But it didn’t pause the action that’s been going on in cyberspace,” U.S. Coast Guard Rear Adm. John Mauger, the director of Cyber Command exercises and training, told reporters Wednesday. “Within Cyber Command we couldn’t stop and that’s really because our adversaries haven’t stopped during this pandemic.”

Although Cyber Command says it was planning to use the platform for the annual exercise, called Cyber Flag, long before the coronavirus started spreading, the pandemic forced the military commanders to reassess how they would work together virtually. It also solidified how important it is for the U.S. military to be able to work with and allies from afar in times of crisis.

“This really is about a new way of training and exercising for this command … the ability to operate over such a distributed format,” Mauger told reporters. “What we found through the rapid development and use of the PCTE is that … it reforms how we are moving forward with training. Our defense is only as strong as our weakest link. So we have to have the capability to train like we fight across the domain and bring in that broader group of allies and partners into the operations.”

The simulation

The exercise took place over the course of two weeks, with fake adversaries targeting virtualized industrial control systems and supervisory control and data acquisition networks (ICS/SCADA), military commanders involved in the exercise said.

The defenders, or blue teams, were made of several different sets of allied and U.S. cyber personnel, including those in the Five Eyes intelligence alliance from the U.K., New Zealand, and Canada, as well as participants from the U.S. Navy’s Fleet Cyber, the U.S. Marine Corps Forces Cyberspace Command, U.S. Army Cyber Command, the U.S. Coast Guard’s cyber branch, the U.S. Department of Energy, and the National Guard. Over 500 people participated in all.

On the simulated airfield, the red team pretending to be the adversaries — a team made up of just Cyber Command and U.S. Army 1st Information Operations Command staff — conducted “standard types of red team actions,” according to a technical director that spoke with CyberScoop. This included gaining initial access to a work station via spearphishing. The attackers then moved laterally to other machines to spread the infection and escalated their privileges.

The red team used all unclassified software to run their intrusions, such as the penetration testing tools Cobalt Strike, Metasploit, and PoshC2. The blue teams then were responsible for detecting the adversaries’ actions and stamping them out of their networks.

While many personnel participated from home, three teams did have to work together in person. To ensure that they could appropriately physical distance to reduce the spread of COVID-19, the operation took place over the course of two weeks, rotating teams in and out of facilities, according to Cyber Command.

The exercise wraps up at the end of this week, so the results are not yet available.

The real-world implications of this exercise are vast. For example, in 2016 when Cyber Command targeted and disrupted ISIS propaganda operations, the command could quickly build out all of its knowledge of ISIS operations in a PCTE simulation to better prepare to target the terrorists’ computer networks at a later date.

Cyber Command could also use the PCTE to train Department of Defense personnel and private sector entities on adversarial malware and tools Cyber Command finds when it hunts for adversarial malware on allies’ networks, such as Russian or Chinese malware.

Defense bill addresses secure phones, AI training, cyber troop mental health

The compromise legislation has other cyber provisions besides on commercial spyware, joint NSA-Cyber Command leadership and streamlining regulations.

While White House demands deterrence, Trump shrugs

Former NSA, Cyber Command chief Paul Nakasone says U.S. falling behind its enemies in cyberspace

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure