A suspicious wireless network masquerading as an ordinary iPhone connection, a concealed microphone capable of exposing sensitive information and a booby-trapped surprise awaiting unsuspecting defenders were among the challenges facing IDF technology cadets during a five-day cyberwarfare exercise in southern Israel.
But the exercise was about more than identifying security vulnerabilities. Rather than developing theoretical projects that would be discarded once their training ended, the cadets built two operational tools designed to address real needs within the Israel Defense Forces and the broader security establishment.
Gallery
IDF officers and technology cadets discuss their work during a training exercise in which teams developed intelligence tools and tested their resilience against cyberattacks
(Photo: IDF)
The exercise, held for the first time at the IDF's new communications and technology campus in southern Israel, brought together officer cadets completing their advanced technological training at Training Base 7, known as Bahad 7, and approximately 160 additional soldiers from the military's communications and technology units.
The participants were divided into development, defense and attack teams, creating a simulated technological battlefield in which the systems being built were simultaneously subjected to attempts to compromise them.
The cadets were assigned responsibilities reflecting the positions they are expected to assume in the coming months, including software development, cyberdefense and simulated offensive operations.
To make the exercise resemble the challenges of commanding an actual military unit, the cadets were placed in charge of teams comprising both career service members and conscripts. Some of the participating soldiers had only recently enlisted, while others were approaching the end of their mandatory service.
The result was a test not only of technical expertise but also of leadership, teamwork and the ability to deliver working technological solutions under pressure.
Turning online threats into actionable intelligence
One of the two development teams, operating under the name Rose, was tasked with building a system capable of identifying potential threats against Israelis at home and abroad.
The platform analyzes publicly available information and seeks to transform suspicious online activity into real-time alerts that can be assessed by relevant security personnel.
An IDF technology officer cadet works at a computer during a five-day cyberwarfare exercise at the military's communications and technology campus in southern Israel
(Photo: IDF)
One potential scenario involves a message on Telegram discussing plans to attack a Chabad center in a popular tourist destination.
The system is designed to examine the content, assess the credibility and severity of the threat and forward relevant findings for human review.
"The software identifies suspicious keywords, such as 'weapon' and 'terror attack,'" said Cadet D., who commanded the Rose team during the exercise.
"We're also examining the possibility of monitoring broadcasts and extracting essential information from them."
The goal is to help security personnel identify potentially significant threats amid the enormous volume of information circulating online, allowing human analysts to focus on cases that warrant closer examination.
The project also presented the cadets with a leadership challenge.
Rather than working exclusively with fellow trainees, they commanded teams that included both experienced career personnel and younger soldiers, mirroring the composition of the units they will eventually lead.
The cadets held individual discussions with their team members to understand their capabilities and assigned responsibilities according to each soldier's skills and strengths.
Monitoring tens of thousands of media reports
A second development team, called Galileo, worked on a system designed to monitor media coverage and identify reports mentioning the IDF.
The team had established contact with the intended users of the system about a month before the exercise, but the actual development work was concentrated into the final five days.
Two IDF soldiers examine computer systems during an exercise designed to identify cybersecurity vulnerabilities and test military defenses
(Photo: IDF)
"We discovered that until now, this task was performed manually," said Cadet M., who commanded the Galileo team.
"People would literally go through official and unofficial media channels looking for mentions of the military. Obviously, that's quite slow, and a lot of things can be missed."
The new system aims to automate much of that process.
One of its central challenges is collecting and processing information on a large scale, potentially involving tens of thousands of reports each day.
"We try to cast a wide net with keywords and then narrow things down," said Cadet T., who was responsible for the system's information-gathering component.
The platform sorts reports according to several criteria, including the reach of a publication, how unusual its content is and the reliability of its source.
The developers also want to track fabricated reports and assess how they influence the broader information environment.
"We also want to monitor fictitious publications and build a situational picture that takes their impact into account," Cadet T. explained.
Artificial intelligence plays a central role in the system's analytical capabilities.
Using AI, the platform can group multiple reports concerning the same subject or event, reducing duplication and allowing analysts to examine broader patterns.
It can also help identify deeper trends in international public opinion, providing insights beyond the monitoring of individual news reports.
For the cadets, the project demonstrated how a relatively short development effort could produce a tool with practical applications across the military.
"Beyond being just an exercise, we understand how much the network we've developed can help both within the military and with our image and public diplomacy toward the entire world," Cadet T. said.
Defending the systems against their own colleagues
While the Rose and Galileo teams developed their platforms, another group of cadets was assigned an equally important mission: protecting the systems from attacks.
The defenders were responsible for identifying vulnerabilities, preventing unauthorized access and investigating attempts to compromise the newly developed tools.
IDF technology cadets gather for a briefing during a cyberwarfare exercise involving simulated attacks and defensive operations
(Photo: IDF)
In actual military operations, such threats can come from hostile states, hackers affiliated with terrorist organizations and other coordinated cyber operations.
During the exercise, however, the attackers were fellow officer cadets.
The opposing teams were divided into a blue team responsible for defense and a red team tasked with testing those defenses through cyberattacks and physical intrusion methods.
The arrangement created a competitive environment in which the defenders had to anticipate how their colleagues might attempt to penetrate the systems.
For Cadet A. and Cadet R., members of an attack investigation team, the exercise produced a particularly unusual discovery.
"We're an attack investigation team, the people who trace every intrusion or compromise of a system," they explained.
During their inspections, the cadets discovered a microphone component that had been secretly installed in one of the workstations.
The device was part of an attempt by the attacking team to gain access to information from the defenders' environment.
"In our scans, we identified a microphone component implanted in one of the stations," the cadets said.
"We removed its memory and connected to the system operating it."
The attackers had attempted to conceal the device by giving its wireless network an innocuous name that suggested it belonged to an ordinary smartphone.
"They may have given the Wi-Fi network an innocent name so we'd think it was someone's iPhone, but it allows them to access our information, what we're typing, screenshots and so on," the cadets said.
"And now we're examining how to exploit that against them."
The discovery illustrated how security threats are not limited to malicious software or conventional hacking attempts.
A physical device concealed inside an otherwise legitimate work environment can also become a means of compromising sensitive systems.
The attackers' mission: Expose vulnerabilities before the enemy does
Despite their adversarial role, the red team's objective was not simply to defeat the defenders.
The attackers, who specialized in both cyber operations and physical intrusion techniques, were tasked with demonstrating vulnerabilities that could have serious consequences if overlooked in an operational environment.
IDF soldiers work together at computer stations during a training exercise simulating the development and defense of military technology systems
(Photo: IDF)
Cadet D., who was responsible for developing physical attack devices, said the exercise was intended to reinforce the importance of security testing, even when it slows the deployment of new technology.
"The idea is to raise awareness of the dangers," he said.
"I often speak with people who are frustrated by how long it takes to approve and secure their products. And we tell them: 'If we deploy something and it allows a breach into highly classified networks, what have we gained?'"
The attackers demonstrated several methods of compromising technological systems, including techniques that did not require installing conventional surveillance sensors inside the targeted equipment.
Another cadet presented a device intended to illustrate how information might be extracted by exploiting electrical activity associated with electronic equipment.
"You don't even need to install a special sensor," the cadet said. "It's enough to bring our component close to the electrical current of the target device, and through it you can extract sound, visuals, whatever you want."
The demonstration was intended to show how seemingly minor security weaknesses can expose information even when a system appears adequately protected against conventional cyberattacks.
For the future officers, the lesson was that protecting military technology requires attention to both software vulnerabilities and the physical environment in which equipment operates.
A final surprise inside the defense headquarters
As the exercise approached its conclusion, the red team prepared one final challenge.
The attackers had secretly placed a device inside the defenders' headquarters that, if activated, would release a shower of paper messages into the room.
IDF technology cadets collaborate during a five-day cyberwarfare exercise at the military's communications and technology campus in southern Israel
(Photo: IDF)
The device, described as a confetti-style bomb, was designed to provide a dramatic demonstration of the attackers' ability to penetrate the heart of the supposedly secure environment.
Its activation depended on whether the blue team discovered the device before the exercise ended.
If the defenders failed to identify it, the attackers planned to press a red button and trigger the release, revealing how deeply they had managed to infiltrate the headquarters.
The surprise served as a final reminder that a successful cyberattack does not necessarily begin with sophisticated malicious code. Sometimes, it can involve a physical object placed where defenders least expect it.
The exercise brought together the different stages of military technology development, from identifying an operational requirement and building a working system to securing it against both digital and physical threats.
For the cadets, it also offered a preview of the responsibilities awaiting them as officers in the IDF's communications and technology units.
Their challenge was not merely to produce software that worked, but to lead teams capable of developing systems quickly while ensuring that those systems would not become an entry point for hostile actors.
And for the blue team, the final test remained unresolved until the last moments of the exercise: whether they could uncover the red team's hidden surprise before someone pressed the button.