Lt. Gen. Stephen Fogarty, head of Army Cyber Command, outlined a 10-year modernization effort to prepare the Army for information warfare and support the service’s multi domain operations concept., C4ISRNET reported Tuesday.

Fogarty and Bryan Sparling, a retired Army colonel who serves as ARCYBER's information warfare transformation adviser, co-wrote the modernization plan published in the summer edition of the Cyber Defense Review.

The multiyear plan consists of three phases and the initial phase seeks to “achieve irreversible momentum toward full-spectrum, integrated IW capability” by mid-2021. These include the relocation of ARCYBER headquarters from Fort Belvoir in Virginia to Fort Gordon in Georgia and the formation of 12 expeditionary cyber teams within the 915th Cyber Warfare Battalion to achieve full operating capability.

Fogarty and Sparling also offered information on the functions of the Cyber Protection Brigade, 1st Information Operations Command and Offensive Cyber Operations Signal Battalion.

Phase 2 will occur between 2021 and 2027 and will focus on experimentation and innovation to address operational challenges posed by emerging technologies. The authors presented their specific plans for the Information Warfare Operations Center, Military Intelligence Brigade and modernization of Network Command, among others.

The third phase will kick off in 2028 and will focus on the deployment of information warfare capabilities in support of multi domain operations. Under this phase, the Army should be able to carry out intelligence and counter-adversary reconnaissance, succeed in unconventional and information warfare and demonstrate credible deterrent.

The U.S. Air Force is implementing an “initial qualification training” approach for defensive cyber operations to support its network modernization initiatives amid the ongoing pandemic, C4ISRnet reported Tuesday.

Lt. Col. Jonathan Williams, commander of the Air Force’s 39th Information Operations Squadron, told the publication that the service branch wants to move away from blanket training approaches for specific systems supporting the Air Force Network (AFNET).

According to Williams, trainees leveraged remote tools to support distance learning as well as limited in-person classes focused on combined cyber mission force and defensive cyber skills refinement.

He noted that he intends to “tailor the training” for cyber mission forces while accommodating adjustments due to the COVID-19 pandemic.

“When all this kicked off, we prioritized all of the mission essential courses that are supplying operators to the cyber mission force,” he said. “We wanted to make sure that those units continue to get the trained operations that they needed so that their readiness levels didn’t suffer.”

The Cybersecurity and Infrastructure Security Agency (CISA) and a U.K.-based cybersecurity center have investigated and released findings on the QSnatch malware that has been used against network-attached storage devices.

The joint investigation found that the malware may have been used in a campaign that ran from 2014 to 2017 and in a second one between 2018 and 2019, CISA said Monday.

QSnatch is known as a tool of cyber actors who have targeted devices made by company QNAP. The malware may still pose a threat to unpatched devices. CISA also noted that the cyber actors have exhibited an understanding of operational security.

QSnatch has features that allow users to steal passwords and system configuration files, scrape credentials, apply arbitrary codes via a backdoor and remotely access assets. The investigators recommend organizations only purchase QNAP products from verified sources and block external links if the device is used solely as internal storage.