U.S. Cyber Command conducts Hunt Forward Operation in Lithuania

May 6, 2022

At the invitation of the Lithuanian government, U.S. Cyber Command’s Cyber National Mission Force deployed a hunt forward team to conduct defensive cyber operations alongside partner cyber forces, concluding in May.

For three months, the U.S. cyber operators hunted for malicious cyber activity on key Lithuanian national defense systems and Ministry of Foreign Affairs’ networks alongside its allies.

This was the first shared defensive cyber operation between Lithuanian cyber forces and CNMF in their country.

“This hunt forward operation is a great example of how cyber is a team sport, and we have to play it together,” said U.S. Army Maj. Gen. Joe Hartman, the CNMF commander. “With these missions, we see a broader scope of how these bad actors are trying to attack important government networks.”

The objective of the hunt forward operation was to observe and identify malicious activity that threatens both nations, and use those insights to bolster homeland defense and increase the resiliency of critical networks to shared cyber threats.

“The war in Ukraine has shown that cyber-attacks are an integral part of modern warfare. We therefore need to prepare in advance and build capacity to ensure the secure security of our critical networks in both peace and war. The operation carried out in Lithuania for three months provided a lot of valuable knowledge to all participants of the operation,” said Margiris Abukevičius, the Lithuania deputy Minister of National Defense, during the closing ceremony of the HFO.

Hunt Forward Operations are defensive cyber operations that are intel-driven and partner-requested. As of May 2022, CNMF has conducted 28 HFOs undertaken across the globe in 16 countries, including, Estonia, Lithuania, Montenegro, North Macedonia and Ukraine.

While deployed, CNMF cyber operators sit side-by-side with the partner and hunt on the networks of the host nation’s choosing, looking for bad cyber activity and vulnerabilities. These insights are shared with the host nation and then brought back to share with public and private sector networks-- bolstering homeland defense before those adversary tactics, techniques, and procedures may be used against the U.S.

“Thanks to our Lithuanian counterparts, we can share that insight to bolster collective cybersecurity across the government and private sector,” Hartman said. “We are incredibly grateful to our Lithuanian allies for allowing us to hunt alongside them for malicious cyber activity, and then strengthen both our nation’s cyber defenses.”

Hunt Forward teams play a crucial role in CYBERCOM’s “persistent engagement,” an effort aimed at proactively defending the U.S. against malicious cyber activity.