Cyber Phoenix 2026: Joining Forces Against Hybrid Threats

15 September 2026

Around 40 German and Dutch reservists faced a realistic hybrid attack scenario during the fifth edition of the “Cyber Phoenix” cybersecurity exercise. Conducted in the Cyber Range of the Research Institute CODE, the exercise demonstrated why multinational cooperation is essential to countering complex cyber threats.

How can complex cyberattacks be detected and countered when digital sabotage is deliberately combined with disinformation? Around 40 reservists from the Bundeswehr and the Dutch Armed Forces confronted this challenge during the binational “Cyber Phoenix” cybersecurity exercise. The one-week exercise took place for the fifth time in the Cyber Range of the Research Institute CODE in Munich.

Since 2021, Cyber Phoenix has provided participants with an opportunity to apply and further develop the knowledge and skills they have largely acquired in their civilian careers under realistic conditions. The CODE Cyber Range provides a virtualized and fully isolated training environment in which complex attack scenarios can be simulated without putting civilian or military production networks at risk.

^{The Cyber Phoenix was held for the fifth time in the Cyber Range of the Research Institute CODE in Munich. Once again, participants from the Netherlands also took part this year. (Photo: © RI CODE)}

Throughout the exercise week, the reservists worked through a demanding scenario developed specifically for this year’s edition by the Cyber Range team. The scenario incorporated current insights into attack patterns and vulnerabilities. Drawing on real-world incidents from modern conflicts, it confronted participants with a threat in which technical attacks and information operations were closely intertwined.

Digital Sabotage and Disinformation

The scenario began with the covert infiltration of a communications network in an allied area of operations by a state actor. Using compromised software, the attackers gained access to the industrial control systems of a strategically important broadcasting and signal station with the aim of manipulating its transmission antennas.

The attack on the technical infrastructure, however, was only one part of the threat. At the same time, the adversary deliberately spread false reports and manipulated situational information through social media. The disruption of the broadcasting facility was intended to cut off official information channels used by public authorities. This created a complex crisis: while reliable information could no longer reach the population and deployed forces, false reports were able to spread largely unchecked, creating uncertainty and undermining situational awareness.

^{During Cyber Phoenix, reservists from the Bundeswehr and the Dutch Armed Forces train together. (Photo: © RI CODE)}

The exercise scenario thus highlighted the systemic nature of hybrid threats. Cyberattacks do not always target individual IT systems alone. When combined with manipulation of the information environment, their effects can extend far beyond the technical domain. Successfully countering such attacks requires technical analysis capabilities, a reliable common operational picture, and coordinated operational decision-making to work hand in hand.

Multinational Cooperation as a Key Element

Multinational teamwork is therefore a key element of Cyber Phoenix. German and Dutch reservists contributed their different professional backgrounds and tactical approaches to addressing the scenario. Working together not only fostered a mutual understanding of processes and procedures, but also strengthened cooperation and cohesion among the participating teams.

On the fourth day of the exercise, the Chief Information Security Officer of the Bundeswehr (CISOBw), Colonel Dr. Christian Czosseck, and the Chief of Staff of the Bundeswehr Cyber Security Center (ZCSBw), Captain Dr. Patrick Jungkunz, visited Cyber Phoenix. On site, they received briefings on the progress of the exercise, the current scenario, and the technical capabilities of the Cyber Range. They also gained first-hand insights into the work of the multinational teams and how they were responding to the complex hybrid threat environment.

^{Colonel Dr. Christian Czosseck (left), Chief Information Security Officer of the Bundeswehr (CISOBw), and Captain Dr. Patrick Jungkunz, Chief of Staff of the Bundeswehr Cyber Security Center (ZCSBw), during their visit at Cyber Phoenix. (Photo: © RI CODE)}

The fifth edition of Cyber Phoenix underscored the importance of realistic training formats for strengthening and maintaining cyber defense capabilities. At the same time, the exercise once again demonstrated the importance of regular professional exchange and cross-border cooperation in preparing for current and future threats in the cyber and information domain.

^{Photos: © RI CODE / Merkl}