US sent ‘hunt-forward’ team to Albania in wake of Iranian cyberattacks

WASHINGTON — U.S. cyber specialists spent three months in Albania working alongside forces there to identify network weaknesses and hacking tools following Iranian cyberattacks on government systems.

The so-called hunt-forward operation, a defensive measure taken at the invitation of foreign officials, was the first conducted in Albania, a smaller NATO ally. U.S. Cyber Command revealed the operation, handled by its Cyber National Mission Force, or CNMF, on March 23.

Army Maj. Gen. William Hartman, the commander of the mission force, in a statement said the operation brought CYBERCOM personnel “closer to adversary activity” while promoting international relationships.

“In an increasingly dynamic environment where malicious cyber actors attempt to exploit our networks, data, and critical infrastructure, we have a key asymmetric advantage that our adversaries don’t have: enduring partnerships, like this one with Albania,” he added.

Iran targeted Albanian networks in July and September, forcing offline key government services including the Total Information Management System, which tracks details of those entering and exiting the country.

The Biden administration condemned the digital belligerence and, ultimately, sanctioned Iran. The administration’s cybersecurity strategy identifies the Middle Eastern country as a burgeoning cyber power and a safe haven for ransomware abusers.

Nathaniel Fick, the U.S. ambassador at large for cyberspace and digital policy, in a statement Thursday said the U.S. remains committed “to working with Albania on securing its digital future, and ensuring that connectivity is a force for innovation, productivity, and empowerment.” He also called on other countries to hold Iran accountable for “its destructive cyberattacks.”

RELATED

Election-defending Cyber National Mission Force elevated by Pentagon

The force has been integral to the command’s work to secure U.S. elections, including the midterms this year.

By Colin Demarest

The CNMF has deployed more than three-dozen times to at least 22 countries — including Ukraine, ahead of Russia’s invasion — to bolster faraway networks and return with information that can be applied stateside.

Hunt-forward operations are part of CYBERCOM’s persistent engagement strategy, a means of being in constant contact with adversaries and ensuring proactive, not reactive, moves are made.

“When we are invited to hunt on a partner nations’ networks, we are able to find an adversary’s insidious activity in cyberspace and share with our partner to take action on,” Hartman said. “We can then impose costs on our adversaries by exposing their tools, tactics and procedures, and improve the cybersecurity posture of our partners and allies.”

More In Cyber

South Korea to deploy laser weapons to intercept North Korean drones

The Defense Acquisition Program Administration said it will deploy at least one anti-air laser weapons system — called “Block-I” — this year.

US to send Tomahawks, hypersonics, other long-range fires to Germany

The move is in-line with the Army's plan to provide such capability to its Multidomain Task Force there.

Beavers takes reins from Sherman as acting DOD information officer

As the most senior IT advisor to the secretary of defense, Beavers is taking over from former CIO John Sherman.

Quieting Discord: A new frontier in military leaks and extremism

From secret Pentagon leaks to radicalization in the military community, Discord is continuing to grapple with keeping bad actors off the popular platform.

Astronauts say Boeing space capsule can safely return them to Earth

NASA test pilots Butch Wilmore and Suni Williams launched aboard Starliner capsule early last month.