Core 3 · Cyber Warfare & Advanced Threat Defence
Instructor-led courses that teach your team how state-linked groups break in, hide and prepare to disrupt, and how to catch them in your own environment.
What it is
Cyber warfare is the use of digital attacks by states, or groups acting for them, to spy on, disrupt or weaken another country. Each form below has a recent, publicly attributed example. Read the full guide to cyber warfare
Stealing secrets from governments and companies. The NCSC assessed that APT31 ran reconnaissance against UK parliamentarians.
Breaking systems people rely on. Destructive commands knocked tens of thousands of Viasat KA-SAT broadband modems offline as Russia invaded Ukraine.
Getting inside now to disrupt later. Volt Typhoon kept footholds in some US infrastructure networks for at least five years.
Shaping what a population believes. The US seized 32 domains used by Russia's "Doppelganger" campaign to pose as real news sites.
Stealing money to fund a state. The FBI attributed the theft of about US$1.5 billion from the Bybit exchange to North Korea.
Anatomy of a real attack
Six steps from the joint advisory by CISA, the NSA, the FBI, the UK NCSC and partners. For each one, the ATT&CK technique it maps to and a related course.
Source: CISA AA24-038A
ATT&CK® technique IDs © 2026 The MITRE Corporation. Reproduced with the permission of The MITRE Corporation.
Extensive research into the target's network, staff and security before any break-in.
Exploited known and zero-day flaws in internet-facing firewalls, VPNs and routers, including CVE-2022-42475 on an unpatched FortiGate. Traffic was routed through end-of-life Cisco and NETGEAR office routers infected with KV Botnet malware, so it appeared to come from ordinary home and small-office connections.
Used vssadmin to make a shadow copy of a domain controller, then ntdsutil to copy out the Active Directory database (NTDS.dit).
Used Windows' own tools, such as wmic, netsh and PowerShell, so there was little malware to find. A netsh PortProxy change turned one internal server into a relay for their command traffic.
Moved between systems over Remote Desktop using stolen administrator accounts, which looks like normal admin work.
Kept access for years, positioned to move from IT into operational technology and disrupt services if tensions escalate.
Case studies
AI-generated illustration2017 · attributed to the Russian military by the UK government
Disguised as a criminal attack, it was aimed mainly at Ukraine's financial, energy and government sectors, then spread to other businesses in Europe and Russia.
Lesson: Supplier update channels are an attack path, and recovery plans need testing.
UK government attribution, Feb 2018
Related courseSupply Chain and Third-Party Cyber Threat Management
AI-generated illustration2022 · attributed to Russia by the UK's NCSC
An attack on a commercial satellite broadband network, about an hour before Russia's invasion of Ukraine, knocked tens of thousands of modems offline.
Lesson: Civilian networks are wartime targets, and space links are part of your attack surface.
Viasat incident overviewAttribution: NCSC, 10 May 2022
Related courseSpace Cyber Warfare: Satellite Exploitation and Orbital Domain Defence
AI-generated illustration2024 to 2025 · attributed to China
Compromised telecoms providers' backbone and edge routers worldwide to feed an espionage operation.
Lesson: Routers and network devices need the same monitoring as servers.
Related courseAPT Detection and Advanced Threat Hunting
AI-generated illustration2017 · attributed to North Korea by the UK government
Ransomware that affected at least 81 of 236 NHS trusts in England and led to an estimated 19,000 cancelled appointments.
Lesson: Unpatched legacy systems and flat networks let one infection spread.
National Audit OfficeAttribution: UK government, 19 Dec 2017
Related courseCritical Infrastructure Defence: Healthcare and NHS
Sample exercise
Eight process events from a made-up network. Four look like routine admin. Four follow the Volt Typhoon pattern. Can you find them before the scan does?
title: NTDS.dit copied with ntdsutil IFM
logsource: { product: windows, category: process_creation }
detection:
sel:
Image|endswith: '\ntdsutil.exe'
CommandLine|contains|all: ['ac i ntds', 'ifm']
condition: sel
tags: [attack.credential_access, attack.t1003.003]
level: high
---
title: Shadow copy created on a domain controller
logsource: { product: windows, category: process_creation }
detection:
sel:
Image|endswith: '\vssadmin.exe'
CommandLine|contains|all: ['create', 'shadow']
condition: sel
tags: [attack.credential_access, attack.t1003.003]
level: high
---
title: Port proxy added through the registry
logsource: { product: windows, category: registry_set }
detection:
sel:
TargetObject|contains: '\Services\PortProxy\v4tov4\'
condition: sel
tags: [attack.command_and_control, attack.t1090.001]
level: highWevtutil also appears in the advisory's tool list. Here it reads five application events, which on its own is routine. Deciding when a normal tool is suspicious is the skill being taught.
The programme
Pick a role to see a suggested three-course pathway, with total days and list price per person. Team pricing on request.
Pathway total: 10 days · £11,685 per person, list price ex VAT
Get a cohort quote for this pathwayShowing 8 of 35 courses. Prices are per person, excluding VAT.
Booking
Tell us your team size and the topics you need.
We agree the courses, format and any tailoring to your environment.
A free assessment shows where your team is starting from.
Dates, group size and terms are confirmed in writing before you book.
Onsite at your premises anywhere in the world, or live online.
Each person gets a certificate anyone can check at xcademia.com/verify.
AI-generated illustrationWe come to your premises, in any country.
AI-generated illustrationInstructor-led in real time, not pre-recorded, for teams in any time zone.
AI-generated illustrationA facilitated exercise in which your team works through a simulated state-linked intrusion.
Public reporting
Government-attributed campaigns. Not a live feed.
Salt Typhoon · attributed to China
State-sponsored actors compromised telecoms providers' backbone and edge routers worldwide to support espionage.
Sectors: Telecoms, government, transport, military · CISA, NSA, FBI and partners including the UK NCSC, AA25-239A (opens in a new tab)
APT28 (GRU unit 26165) · attributed to Russia
Russian military intelligence targeted organisations involved in delivering foreign assistance to Ukraine.
Sectors: Logistics, defence, maritime, air traffic management, IT services · CISA, NSA, FBI, UK NCSC and partners, AA25-141A (opens in a new tab)
TraderTraitor (Lazarus) · attributed to North Korea
The FBI attributed the theft of about US$1.5 billion in virtual assets from the Bybit exchange to North Korea.
Sectors: Finance, cryptocurrency · FBI (opens in a new tab)
Iranian cyber actors · attributed to Iran-based actors
Used brute force and MFA push-bombing to get into accounts at critical infrastructure organisations. The advisory says they likely sold the access on to cybercriminals.
Sectors: Healthcare, government, IT, engineering, energy · FBI, CISA, NSA and partners, AA24-290A (opens in a new tab)
APT31 · attributed to China
The NCSC assessed that APT31 conducted reconnaissance against UK parliamentarians, and that a China state-affiliated actor highly likely compromised the Electoral Commission.
Sectors: Government, democratic institutions · UK NCSC (opens in a new tab)
Volt Typhoon · attributed to China
State-sponsored actors pre-positioned inside US critical infrastructure networks and maintained persistent access.
Sectors: Communications, energy, transport, water · CISA, NSA, FBI and partners including the UK NCSC, AA24-038A (opens in a new tab)
Cyber warfare is the use of digital attacks by states, or groups acting for them, to spy on, disrupt or weaken another country. It takes five main forms: espionage, sabotage, pre-positioning, influence and state-backed theft.
Security teams in organisations that state-linked groups target: government and defence, critical national infrastructure, healthcare, finance, telecoms and their suppliers. Courses run from Foundation to Expert level.
Yes. We deliver onsite at your premises anywhere in the world, and live online for teams in any time zone. If your site has security clearance or vetting requirements for visitors, tell us when you enquire and we will confirm whether we can meet them before you book.
Courses in this track run from 2 to 10 days depending on the subject. Each course page shows its length and list price per person, excluding VAT. Team pricing is available on request.
Each course page lists the frameworks the course refers to, such as MITRE ATT&CK, NCSC CAF, NIS2 and NIST CSF 2.0. Training can help you evidence parts of these frameworks, but completing a course does not by itself make an organisation compliant.
Tell us about your team. Someone from Xcademia will reply by email or phone.