BUCHAREST, ROMANIA -- As part of the DEFENDER 25 multinational exercise between the U.S. Army and NATO, cyber operators from the Maryland Air National Guard partnered with Romanian Cyber Command counterparts to conduct a cyber warfare exercise under the umbrella of Saber Guardian 25, June 9-24, 2025.
Saber Guardian 25 was a key training exercise that focused on enhancing coordination and interoperability across NATO partners and allies, bringing together cyber defense teams to simulate real-world scenarios that reflect the increasing complexity and prominence of cyber operations in modern conflict.
Approximately 50 Airmen from the 175th Cyberspace Operations Group integrated with Romanian cyber counterparts to test the abilities of allies to respond in unison to large-scale digital attacks, emphasizing joint planning and rapid response capabilities. The exercise implemented scenario planning and tactics to protect and secure simulated supervisory control and data acquisition – commonly referred to as SCADA – systems and infrastructure (e.g., electricity, water, facilities, etc.) from cyberattacks.
“Exercises like Saber Guardian ensure we’re not just interoperable on the ground and in the air, but also across networks and cyber environments, where our adversaries are increasingly active and aggressive,” said Maryland Air National Guard Maj. Brandon Krantz, an operations officer assigned to the 275th Operations Support Squadron.
During the exercise, participants were tasked with identifying and neutralizing a series of coordinated cyberattacks, emulating a hostile adversary targeting NATO communications, logistics systems, and battlefield command networks. Teams worked in real time to share threat intelligence, isolate compromised systems, and implement countermeasures. A key focus was on cyber situational awareness, enabling exercise participants to make informed decisions based on simulated evolving threats.
For the exercise scenario, the Maryland Air National Guard provided a training range that emulated a local base network connected to the municipal industrial control system and SCADA components for traffic lights, as well as seaport and inland waterway operations. U.S. and Romanian exercise participants were organized into teams with specific roles that focused on different aspects of security testing.
The blue team (defensive cell) was tasked with defending a simulated network from an attack by hunting for vulnerabilities and malicious cyber actors. The blue team was responsible for providing recommendations to resolve these vulnerabilities and securing the network.
The red team (offensive cell) attempted to cause disruptions to operations by denying, degrading, or destroying critical cyber infrastructure key to mass military movements via unauthorized access, emulating an adversarial cyber threat in the network.
The purple team (defensive cyber operations response actions cell) collaborated with the blue team to utilize offensive cyber tactics to access the red team’s infrastructure and deny their ability to affect mass military movements.
The white team monitored the exercise and ensured that both teams were following the rules.
“Exercises like this are important because it provides a controlled environment to simulate threats to refine response procedures and correct interoperability gaps,” said Romanian Cyber Command Lt. Col. Radu Pasnicu, Romania head of the cyber virtual training environment. “These exercises help us identify strengths and weaknesses in our equipment, communications and joint-mission execution.”
In addition to joint operations testing, the exercise brought NATO partner nations together for joint training opportunities, focusing on sharing best practices in cyber defense, streamlining procedures and protocols, and general collaboration and partnership across teams and participants.
“One of the main drivers in participating in an exercise like DEFENDER 25 is ensuring our cyber forces are able to provide integrated defense of our NATO partners,” said Maryland Air National Guard Capt. Evan Pelecky, a cyber operator assigned to the 275th Operations Support Squadron and DEFENDER 25 exercise director for the cyber syndicate. “Even in a cyberspace domain where you’re often interacting across remote platforms, having sit downs and face-to-face interaction with coalition partners is extremely invaluable in terms of providing that integrated defense when it comes to potential armed conflict.”
The exercise also presented Maryland cyber operators with follow-up training opportunities to two trilateral exercises between the U.S., Poland, and Estonia: Baltic Blitz 23, which used blue and red teams to secure simulated rail transportation systems from cyber attacks, and Cyber Defender 24, which as part of NATO’s DEFENDER 24 exercise, used blue and red teams in geographically-separated locations to secure simulated HVAC systems and safeguard the Joint Reception, Staging, Onward Movement, and Integration (JRSOI) environment from further harm.
Demonstrating global deterrence and the U.S. Army’s ability to rapidly deploy U.S.-based combat power in Europe and the Arctic region alongside Allies and partners, DEFENDER 25 brings U.S. service members together with forces from 29 Allied and partner nations to build readiness through large-scale combat training from May 11-June 24, 2025. DEFENDER 25 increases the lethality of the NATO alliance through large-scale tactical training maneuvers and long-range fires, builds unit readiness in a complex joint, multinational environment and leverages host nation capabilities to increase the U.S. Army’s operational reach. During three large-scale combat training exercises—Swift Response, Immediate Response, and Saber Guardian—Ally and partner forces integrate and expand multi-domain operations capability, demonstrating combined command and control structures and readiness to respond to crisis and conflict.
Saber Guardian 25, the final exercise of DEFENDER 25, enhances NATO land component mission command and improves coordination among NATO Allied and partner forces in a fast-moving environment. Starting with a long tactical road march by U.S. Army 2nd Cavalry Regiment, the realistic and multi-domain training brings together approximately 10,000 multinational troops from June 9 to 24 and takes place in Czechia, Hungary, and Romania. Saber Guardian 25 also includes convoys, river crossings, live-fire events, and a rocket live-fire exercise, reinforcing U.S. capabilities and readiness to defend its Allies.