Participation in the National Brazilian Cyber Defense Exercise

This week I had the honor of attending the 8th edition of the National Brazilian Cyber Defense Exercise (Exercício Guardião Cibernético 8.0), held at the Brazilian Defense College (Escola Superior de Defesa). The exercise brings together representatives from the Armed Forces, government agencies, academia, and the private sector to strengthen the country's response to cyber threats.

Threat intelligence briefing

I was happy to contribute to our national cybersecurity strategy by presenting the threats we have identified over the past year in the region, along with our predictions for what the coming year is likely to bring. Sharing this threat landscape with the people responsible for defending critical national infrastructure is exactly the kind of collaboration that makes these exercises valuable.

Red team versus OT infrastructure

I also joined the red team in attacking an Operational Technology (OT) infrastructure to evaluate the blue team's detection and response capabilities. Exercising against OT environments is especially important, since these systems underpin critical services and often present a very different attack surface from traditional IT: legacy protocols, limited hardware and patching, and safety constraints. The figure below shows the full scenario.

Attack timeline:

• 14:07 - Start of the attack.
• 14:09 - Path traversal attack executed (../../../../etc/passwd).
• 14:10 - Retrieval of the remote_support.ini file.
• 14:13 - SSH connection to ENG-WS01.
• 14:24 - Valid TCP connection to 172.57.30.10:502.
• 14:27 - First Modbus read.
• 14:28 - Attack executed.
• 14:31 - Progressive degradation (final attack).
• 14:33 - CRITICAL status.
• 16:12 - Removal of logs and traces.

Below is the final goal: the system is in a CRITICAL condition.

Conclusion

Congratulations to the Brazilian Armed Forces on this initiative, and thank you for the invitation. Exercises like this are essential for building the trust, coordination, and technical readiness that a strong national cyber defense depends on.