VIRGINIA BEACH, Va. –
National Guard Soldiers and Airmen and members of the Virginia Defense Force partnered with military and civilian cyber operators Aug. 2-17, 2025, at the State Military Reservation in Virginia Beach, Virginia, during Cyber Fortress 25. They conducted training, a senior leader table top exercise and established enclaves in a “force-on-force” scenario to simulate the process they would follow to respond to and mitigate a cyber attack on an electricity cooperative.
The joint, interagency, intergovernmental multinational exercise focused on electric cooperatives and provided an opportunity to test Virginia’s cyber response plan, better prepare for future collective responses and build resiliency, explained Col. David Garner, the Information Operations Support Center commander and exercise director. In addition, representatives from several foreign militaries participated in the exercise, including a number from Finland, Virginia National Guard’s State Partnership Program's partner
The Fort Belvoir-based 91st Cyber Brigade and IOSC hosted the exercise which included a re-certification of two cyber protection teams and one battalion headquarters as part of their federal mission.
“The annual Cyber Fortress exercise is critical training event used to test the Commonwealth’s ability to respond to a cyber attack,” Garner said. “The relationships and trust built at Cyber Fortress will be put to the test in a real-world event and helps refine the commonwealth’s cyber critical incident response plans and provides an environment where we are continuously improving processes and readiness. The Virginia National Guard will be ready if called upon.”
Garner said the first week of Cyber Fortress was designed to deliver high quality training in the areas of cyber defense of operational technology, the technology used to interact with the physical devices such as an Industrial Control System Supervisory Control and Data Acquisition system. The Soldiers and civilian partners also received training in cyber threat intelligence, malware analysis, and electrical systems.
“This training was attended by a mixed audience of military, federal government, state government, students and members of the electric co-ops,” Garner.
Other key events from the first week were the capabilities briefs, a tabletop exercise and a Distinguished Visitors Day.
The Virginia Department of Emergency Management, the Virginia Army National Guard, the United States Army Reserve and the Cybersecurity and Infrastructure Security Agency were among the many agencies delivering briefs on their agency’s mission and the capabilities they would bring in response to a cyber attack
VDEM led the tabletop exercise and took all of the participants through a scenario where multiple electric co-ops were undergoing coordinated and complex multi-domain cyber and unmanned aerial system attacks.
“Although that scenario was highly unlikely to actually occur, the scenario did foster cross talk among all of the audience to work out how we would respond if something like this were to happen,” Garner said.
The Distinguished Visitors Day audience included executive level leaders from VDEM, CISA, Army Research Labs, DEVCOM, Army Futures Command, foreign military partners including Finland, Sweden, Latvia, the electric co-operatives and the leadership of the Virginia National Guard.
‘DV Day was designed to create an environment where these executives receive briefs, see the technology and talk to the service members about the exercise,” Garner said. “One of the most important aspects of DV Day was the ability to network with other agencies and build relationships that can be called upon if an emergency event happens in the commonwealth.”
The second week of Cyber Fortress 25 was the force-on-force cyber exercise designed to simulate and test cyber incident response to a cyber attack on an electric co-op.
The exercise’s “Red Team” acted as the opposing force and employed tactics, techniques and procedures used by a well-known nation-state sponsored advanced persistent threat actor that targets critical infrastructure.
The “Blue Teams” were broken into eight enclaves charged with the mission of defending a virtual network designed to represent what a typical electric co-op’s information technology network and operational technology network would look like.
The “White Cell” designed the exercise scenario, built the virtual network cyber range, provided exercise control and acted as the higher headquarters.
At the end of the day the Red and Blue Teams would get together to conduct a “Purple Team” after action review where they would discuss the day’s activities.
At the end of the exercise, a final Purple Team brief was conducted where the attackers outlined everything they did in the environment, and the defenders saw if they were successful in their hunt, clear, harden and assess techniques.
Photos:
Military, civilian cyber operators train for response, mitigation at Cyber Fortress 25
~ Photos on Flickr at https://vngpao.info/y4h9f8tn
Cyber Fortress 25 DV Day showcases cyber exercise to military, civilian leaders
~ Photos on Flickr at https://vngpao.info/bdhap5x3
Cyber Fortress 25 brings together federal, state agencies, public sector to test cyber incident response
~ Photos on Flickr at https://vngpao.info/2p99vwfx