---
url: "https://www.xcademia.com/cyber-warfare"
title: Cyber Warfare Training Courses for Security Teams
description: "UK instructor-led cyber warfare training for security teams: nation-state threat detection, APT hunting and CNI defence. Onsite worldwide or live online."
type: landing
topic: "cyber-warfare"
---

# Cyber Warfare Training Courses for Security Teams

> UK instructor-led cyber warfare training for security teams: nation-state threat detection, APT hunting and CNI defence. Onsite worldwide or live online.

## Cyber warfare in five forms

Cyber warfare is the use of digital attacks by states, or groups acting for them, to spy on, disrupt or weaken another country. It takes five main forms: espionage, sabotage, pre-positioning, influence and state-backed theft.

- **Espionage**: Stealing secrets from governments and companies. The NCSC assessed that APT31 ran reconnaissance against UK parliamentarians. Source: [NCSC, 25 Mar 2024](https://www.ncsc.gov.uk/news/china-state-affiliated-actors-target-uk-democratic-institutions-parliamentarians)
- **Sabotage**: Breaking systems people rely on. Destructive commands knocked tens of thousands of Viasat KA-SAT broadband modems offline as Russia invaded Ukraine. Source: [Viasat, 30 Mar 2022](https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/)
- **Pre-positioning**: Getting inside now to disrupt later. Volt Typhoon kept footholds in some US infrastructure networks for at least five years. Source: [CISA AA24-038A, 7 Feb 2024](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- **Influence**: Shaping what a population believes. The US seized 32 domains used by Russia's "Doppelganger" campaign to pose as real news sites. Source: [US DoJ, 4 Sep 2024](https://www.justice.gov/archives/opa/pr/justice-department-disrupts-covert-russian-government-sponsored-foreign-malign-influence)
- **State theft**: Stealing money to fund a state. The FBI attributed the theft of about US$1.5 billion from the Bybit exchange to North Korea. Source: [FBI, 26 Feb 2025](https://www.ic3.gov/PSA/2025/PSA250226)

## Anatomy of a real attack: Volt Typhoon

Six steps from the joint advisory [CISA AA24-038A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a), each with the MITRE ATT&CK technique it maps to.

1. **Reconnaissance**: Extensive research into the target's network, staff and security before any break-in. (T1590 Victim network information; T1591 Victim organisation information)
2. **Initial access through edge devices**: Exploited known and zero-day flaws in internet-facing firewalls, VPNs and routers, including CVE-2022-42475 on an unpatched FortiGate. Traffic was routed through end-of-life Cisco and NETGEAR office routers infected with KV Botnet malware, so it appeared to come from ordinary home and small-office connections. (T1190 Exploit public-facing application; T1584.005 Compromise infrastructure: botnet)
3. **Credential theft**: Used vssadmin to make a shadow copy of a domain controller, then ntdsutil to copy out the Active Directory database (NTDS.dit). (T1003.003 OS credential dumping: NTDS)
4. **Living off the land**: Used Windows' own tools, such as wmic, netsh and PowerShell, so there was little malware to find. A netsh PortProxy change turned one internal server into a relay for their command traffic. (T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1090.001 Internal proxy)
5. **Lateral movement**: Moved between systems over Remote Desktop using stolen administrator accounts, which looks like normal admin work. (T1021.001 Remote Desktop Protocol; T1078 Valid accounts)
6. **Pre-positioning for disruption**: Kept access for years, positioned to move from IT into operational technology and disrupt services if tensions escalate.

ATT&CK® technique IDs © 2026 The MITRE Corporation. Reproduced with the permission of The MITRE Corporation.

## Case studies

- **NotPetya** (2017 · attributed to the Russian military by the UK government): Disguised as a criminal attack, it was aimed mainly at Ukraine's financial, energy and government sectors, then spread to other businesses in Europe and Russia. Lesson: Supplier update channels are an attack path, and recovery plans need testing. Source: [UK government attribution, Feb 2018](https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks)
- **Viasat KA-SAT** (2022 · attributed to Russia by the UK's NCSC): An attack on a commercial satellite broadband network, about an hour before Russia's invasion of Ukraine, knocked tens of thousands of modems offline. Lesson: Civilian networks are wartime targets, and space links are part of your attack surface. Source: [Viasat incident overview](https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/) Attribution: [NCSC, 10 May 2022](https://www.ncsc.gov.uk/news/russia-behind-cyber-attack-with-europe-wide-impact-hour-before-ukraine-invasion)
- **Salt Typhoon** (2024 to 2025 · attributed to China): Compromised telecoms providers' backbone and edge routers worldwide to feed an espionage operation. Lesson: Routers and network devices need the same monitoring as servers. Source: [CISA AA25-239A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a)
- **WannaCry** (2017 · attributed to North Korea by the UK government): Ransomware that affected at least 81 of 236 NHS trusts in England and led to an estimated 19,000 cancelled appointments. Lesson: Unpatched legacy systems and flat networks let one infection spread. Source: [National Audit Office](https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/) Attribution: [UK government, 19 Dec 2017](https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks)

## Courses in this track (35)

- [Cyber Warfare Foundations](https://www.xcademia.com/courses/cyber-warfare-foundations): Foundation, 2 days, from £1,995 per person, ex VAT
- [Hybrid Warfare and Kinetic-Cyber Operations](https://www.xcademia.com/courses/hybrid-warfare-and-kinetic-cyber-operations): Foundation, 2 days, from £2,195 per person, ex VAT
- [Nation-State Threat Actor Profiles](https://www.xcademia.com/courses/nation-state-threat-actor-profiles): Foundation, 2 days, from £2,195 per person, ex VAT
- [AI-Powered Attacks and Autonomous Threat Defence](https://www.xcademia.com/courses/ai-powered-attacks-and-autonomous-threat-defence): Practitioner, 3 days, from £3,695 per person, ex VAT
- [AI-Powered Social Engineering and CEO Fraud Defence](https://www.xcademia.com/courses/ai-powered-social-engineering-and-ceo-fraud-defence): Practitioner, 2 days, from £2,495 per person, ex VAT
- [APT Detection and Advanced Threat Hunting](https://www.xcademia.com/courses/apt-detection-and-advanced-threat-hunting): Practitioner, 4 days, from £4,495 per person, ex VAT
- [Cognitive Warfare and Information Operations Defence](https://www.xcademia.com/courses/cognitive-warfare-and-information-operations-defence): Practitioner, 3 days, from £3,695 per person, ex VAT
- [Counter-UAS and Drone Cyber Warfare Operations](https://www.xcademia.com/courses/counter-uas-and-drone-cyber-warfare-operations): Practitioner, 3 days, from £3,695 per person, ex VAT
- [Critical Infrastructure Defence: Energy, Utilities and Water](https://www.xcademia.com/courses/critical-infrastructure-defence-energy-utilities-and-water): Practitioner, 3 days, from £3,495 per person, ex VAT
- [Critical Infrastructure Defence: Finance and Banking](https://www.xcademia.com/courses/critical-infrastructure-defence-finance-and-banking): Practitioner, 3 days, from £3,495 per person, ex VAT
- [Critical Infrastructure Defence: Healthcare and NHS](https://www.xcademia.com/courses/critical-infrastructure-defence-healthcare-and-nhs): Practitioner, 3 days, from £3,494 per person, ex VAT
- [Cyber-Electromagnetic Operations (CEMA) Fundamentals](https://www.xcademia.com/courses/cyber-electromagnetic-operations-cema-fundamentals): Practitioner, 3 days, from £3,495 per person, ex VAT
- [Deepfake Detection and Synthetic Media Forensics](https://www.xcademia.com/courses/deepfake-detection-and-synthetic-media-forensics): Practitioner, 3 days, from £3,695 per person, ex VAT
- [Financial Cyber Warfare and Sanctions Evasion Defence](https://www.xcademia.com/courses/financial-cyber-warfare-and-sanctions-evasion-defence): Practitioner, 2 days, from £2,495 per person, ex VAT
- [Insider Threat Detection in National Security Environments](https://www.xcademia.com/courses/insider-threat-detection-in-national-security-environments): Practitioner, 3 days, from £3,695 per person, ex VAT
- [Maritime, Aviation and Space Cybersecurity](https://www.xcademia.com/courses/maritime-aviation-and-space-cybersecurity): Practitioner, 3 days, from £3,789 per person, ex VAT
- [OT, ICS and SCADA Security Operations](https://www.xcademia.com/courses/ot-ics-and-scada-security-operations): Practitioner, 4 days, from £4,495 per person, ex VAT
- [SIGINT Awareness and Spectrum Warfare Defence](https://www.xcademia.com/courses/sigint-awareness-and-spectrum-warfare-defence): Practitioner, 2 days, from £2,495 per person, ex VAT
- [State-Sponsored Ransomware: Attribution, Response and National Policy](https://www.xcademia.com/courses/state-sponsored-ransomware-attribution-response-and-national-policy): Practitioner, 2 days, from £2,495 per person, ex VAT
- [Supply Chain and Third-Party Cyber Threat Management](https://www.xcademia.com/courses/supply-chain-and-third-party-cyber-threat-management): Practitioner, 3 days, from £3,495 per person, ex VAT
- [Synthetic Identity, Biometric Fraud and Digital Trust Defence](https://www.xcademia.com/courses/synthetic-identity-biometric-fraud-and-digital-trust-defence): Practitioner, 2 days, from £2,495 per person, ex VAT
- [Synthetic Media, Propaganda and Election Integrity Defence](https://www.xcademia.com/courses/synthetic-media-propaganda-and-election-integrity-defence): Practitioner, 2 days, from £2,495 per person, ex VAT
- [Advanced Drone Exploitation and Swarm Threat Defence](https://www.xcademia.com/courses/advanced-drone-exploitation-and-swarm-threat-defence): Professional, 3 days, from £4,295 per person, ex VAT
- [Agentic AI Threats and Autonomous Cyber Defence](https://www.xcademia.com/courses/agentic-ai-threats-and-autonomous-cyber-defence): Professional, 3 days, from £4,295 per person, ex VAT
- [AI Red Team Operations](https://www.xcademia.com/courses/ai-red-team-operations): Professional, 3 days, from £4,295 per person, ex VAT
- [Cyber Defence Operations and Resilience Command](https://www.xcademia.com/courses/cyber-defence-operations-and-resilience-command): Professional, 5 days, from £4,195 per person, ex VAT
- [Cyber Deterrence, Escalation Management and Red Lines](https://www.xcademia.com/courses/cyber-deterrence-escalation-management-and-red-lines): Professional, 3 days, from £4,495 per person, ex VAT
- [Cyber Lawfare: International Law, LOAC and State Responsibility in Cyberspace](https://www.xcademia.com/courses/cyber-lawfare-international-law-loac-and-state-responsibility-in-cyberspace): Professional, 3 days, from £4,295 per person, ex VAT
- [Multi-Domain Operations and Cross-Domain Cyber Integration](https://www.xcademia.com/courses/multi-domain-operations-and-cross-domain-cyber-integration): Professional, 4 days, from £4,995 per person, ex VAT
- [National Cyber Strategy Development and Governance](https://www.xcademia.com/courses/national-cyber-strategy-development-and-governance): Professional, 3 days, from £4,495 per person, ex VAT
- [Nuclear and CBRN Facility Cyber Protection](https://www.xcademia.com/courses/nuclear-and-cbrn-facility-cyber-protection): Professional, 4 days, from £5,495 per person, ex VAT
- [Space Cyber Warfare: Satellite Exploitation and Orbital Domain Defence](https://www.xcademia.com/courses/space-cyber-warfare-satellite-exploitation-and-orbital-domain-defence): Professional, 4 days, from £4,997 per person, ex VAT
- [Threat Intelligence Analysis and Attribution Tradecraft](https://www.xcademia.com/courses/threat-intelligence-analysis-and-attribution-tradecraft): Professional, 4 days, from £4,995 per person, ex VAT
- [Elite Cyber Warfare Practitioner Bootcamp](https://www.xcademia.com/courses/elite-cyber-warfare-practitioner-bootcamp): Expert, 10 days, from £12,995 per person, ex VAT
- [Xcademia ICS and OT Security Practitioner](https://www.xcademia.com/courses/xcademia-ics-and-ot-security-practitioner): Expert, 6 days, from £3,995 per person, ex VAT

## Delivery

- **Onsite, anywhere**: We come to your premises, in any country.
- **Live online**: Instructor-led in real time, not pre-recorded, for teams in any time zone.
- **Crisis wargame**: A facilitated exercise in which your team works through a simulated state-linked intrusion.

## Frequently asked questions

**What is cyber warfare?**

Cyber warfare is the use of digital attacks by states, or groups acting for them, to spy on, disrupt or weaken another country. It takes five main forms: espionage, sabotage, pre-positioning, influence and state-backed theft.

**Who are these courses for?**

Security teams in organisations that state-linked groups target: government and defence, critical national infrastructure, healthcare, finance, telecoms and their suppliers. Courses run from Foundation to Expert level.

**Can you deliver at our site?**

Yes. We deliver onsite at your premises anywhere in the world, and live online for teams in any time zone. If your site has security clearance or vetting requirements for visitors, tell us when you enquire and we will confirm whether we can meet them before you book.

**How long are the courses and what do they cost?**

Courses in this track run from 2 to 10 days depending on the subject. Each course page shows its length and list price per person, excluding VAT. Team pricing is available on request.

**Do the courses make us compliant with NIS2 or the NCSC CAF?**

Each course page lists the frameworks the course refers to, such as MITRE ATT&CK, NCSC CAF, NIS2 and NIST CSF 2.0. Training can help you evidence parts of these frameworks, but completing a course does not by itself make an organisation compliant.

## Related pages

- What is cyber warfare (full guide): https://www.xcademia.com/insights/what-is-cyber-warfare-the-definitive-guide-for-2026
- Cybersecurity and ethical hacking core: https://www.xcademia.com/cores/cybersecurity-ethical-hacking
- Enterprise training: https://www.xcademia.com/enterprise
- Certificate verification: https://www.xcademia.com/verify

---

## About this content

This Markdown landing page is the citation-grade twin of [Cyber Warfare Training Courses for Security Teams](https://www.xcademia.com/cyber-warfare). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://www.xcademia.com/cyber-warfare
- Publisher: Xcademia, https://www.xcademia.com
- Catalogue index: https://www.xcademia.com/llms-full.txt