US deployed team to Albania in wake of Iranian hacking

After Iranian cyberattacks on government networks, U.S. cyber professionals spent three months in Albania, working with forces there to find network holes and hacking tools.

NATO's smallest member state, Albania, played host to the first ever "hunt-forward operation," a defensive measure taken at the request of foreign officials.

On March 23, U.S. Cyber Command announced that its Cyber National Mission Force (CNMF) was in charge of the operation.

In a statement, the mission force's commander, Army Maj. Gen. William Hartman, said that the operation placed CYBERCOM soldiers "closer to adversary operations" while also fostering international partnerships.

“In an increasingly dynamic world where dangerous cyber actors aim to compromise our networks, data, and vital infrastructure, we have a fundamental asymmetric advantage that our adversaries don’t have: durable relationships, like this one with Albania,” he added.

Iran targeted Albanian networks in July and September, forcing offline important government systems including the Total Information Management System, which controls details of persons entering and exiting the country.

The digital hostility was denounced by the Biden administration, and sanctions were imposed on Iran.

According to the government's cybersecurity plan, this Middle Eastern nation is both a rising cyber power and a refuge for those who employ ransomware to extort others.

U.S. Cyber Ambassador Nathaniel Fick said in a statement released on Thursday that the country is "dedicated to working with Albania on securing its digital future, and ensuring that connection is a driver for creativity, productivity, and empowerment."

For "its catastrophic cyberattacks," he demanded that Iran be held accountable.

The CNMF has gone more than three-dozen times to at least 22 nations — including Ukraine, before of Russia’s invasion — to boost remote networks and return with knowledge that can be used stateside.

CYBERCOM's persistent engagement strategy includes hunt-forward operations, which involve maintaining constant contact with adversaries to guarantee proactive, rather than reactive, action.

“When we are invited to hunt on a partner nations’ networks, we are able to detect an adversary’s nefarious activities in cyberspace and communicate with our partner to take action on,” Hartman added.

Then, "we can improve the cybersecurity posture of our partners and allies," as well as "impose costs on our adversaries by disclosing their tools, strategies, and procedures."