U.S. military sends cyber team to ‘hunt’ foes from NATO ally next to Russia

A U.S. military cyberwarfare team has recently conducted a “defensive hunt operation” in the Baltic NATO state of Lithuania amid heightened tensions surrounding Russia’s ongoing war in Ukraine, U.S. Cyber Command (CYBERCOM) has told Newsweek.

In a statement, CYBERCOM said that the second such deployment since May of last year, just months into the Russia-Ukraine conflict, was led by operators attached to the Cyber National Mission Force (CNMF), alongside counterparts from the Lithuanian Interior Ministry’s Information Technology and Communications Department.

Throughout the months-long deployment, “the teams analyzed key networks, identified and prioritized by the partner, for evidence of malicious cyber activity while identifying vulnerabilities,” the statement said. Few details of the mission have been made public.

A CNMF spokesperson declined to “get into specifics of our tactics, techniques and procedures,” but told Newsweek that the elite cyber force’s “core mission is to defend the nation in and through cyberspace, halting, disrupting, and/or increasing the costs on adversaries who are attempting to interfere in our democratic processes, steal our intellectual property, or attack our critical infrastructure.”

“Defend Forward Operations are being conducted because adversaries are routinely executing operations against their neighbors,” the CNMF spokesperson said. “As long as adversaries target our partners, and if those partners invite us, we’re going to go there and hunt.”

“We operate together in cyberspace to learn from one another and share information on threats which helps to harden/enhance the security of the networks on which the U.S. and our ally depends,” the spokesperson added.

Established in 2014, the CNMF constitutes one third of a triad of CYBERCOM forces that also includes the Cyber Combat Mission Force and Cyber Protection Force. According to CYBERCOM’s statement, the CNMF “has deployed 50 times and conducted hunt operations on over 75 networks in more than 23 countries.”

In addition to Lithuania, nations to which the CNMF has deployed in Eastern Europe include Albania, Croatia, Estonia, Latvia, Montenegro, North Macedonia and Ukraine, which has accused Russia of mounting a cyberwarfare campaign alongside its kinetic attack against the neighboring nation.

While a number of countries, including the United States, have accused Russia of malign activities in the digital realm, anxieties over potential vulnerabilities in this domain have increased considerably since the Russia-Ukraine conflict erupted.

“We need to develop competences and be more resilient to cyberattacks,” Lithuanian Vice Interior Minister Arnoldas Abramavičius, said in the CYBERCOM statement. “The war in Ukraine has shown that cyberattacks are a powerful tool of modern warfare, so it is extremely important to be prepared and to ensure the security of our networks.”

“I believe that the results of this mission will be mutually beneficial and contribute to creating a common area of security and democracy in our region,” he added.

Lithuania, a former Soviet republic, borders Russia’s heavily militarized Kaliningrad semi-exclave region and has been an ardent support of Ukraine throughout the conflict. Concerns over the Baltic country’s security following the first eruption of unrest tied to Russia in Ukraine in 2014 led to the formation of a multinational NATO battlegroup in Lithuania, alongside three others in Estonia, Latvia and Poland.

CNMF commander Army Major General Joe Hartman also weighed in on the conditions surrounding the latest operation, stating that “cyber threats rarely occur in a vacuum.”

“Ultimately, what impacts one nation or network can impact us all,” Hartman said in the CYBERCOM statement, “and that is why we are fortunate to have opportunities such as these to work side by side with trusted partners in Lithuania.”

News of the operation comes just days after Moscow’s top cyber diplomat told Newsweek that it was Washington that was behind an escalating trend of attacks in the realm of information and communication technologies (ICTs).

Dismissing “a lack of hard evidence” to back up claims that the Kremlin engaged in such illicit activities, Artur Lyukmanov, director of the Russian Foreign Ministry’s International Information Security Department and special representative to President Vladimir Putin on international cooperation on information security, said “the U.S. builds up offensive ICT-capabilities, conducts ‘hunt-forward’ operations against Russia” and “employs its clients abroad.”

Lyukmanov made specific reference to so-called “cyber laboratories” set up by CYBERCOM across NATO states in Eastern Europe.

“We want to halt further deterioration,” Lyukmanov said at the time. “A mistake in the use of ICTs may lead to a direct conflict, an all-out war, especially as that the White House is aware that Russia has all the necessary capabilities to defend itself. A devastative computer attack against our critical information infrastructure will not be left without response.”