A multinational group of cybersecurity experts man their posts during a simulated cybersecurity exercise as part of Cobra Gold in Nong Phai Lom, Thailand, on March 4, 2025. (Alex Wilson/Stars and Stripes)
NONG PHAI LOM, Thailand — Missile launches and small-arms fire are integral to Cobra Gold, the largest joint military exercise in mainland Asia, but a quieter form of warfare has steadily evolved during the annual event.
Teams from seven nations, including the U.S. and host country Thailand, convened far from simulated battlefields Tuesday to polish their digital defense skills by monitoring web traffic, satellite relays and data transfers for malware and other forms of cyberattacks.
The exercise, Cyber Ex, is in its seventh year at Cobra Gold and has progressively improved since its inception in 2019, according to Maj. Andrew Van Zandt, a cyberspecialist with the 252nd Cyberspace Operations Group, an Air National Guard unit at Joint Base Lewis-McChord, Wash.
“I’ve worked with a few partner nations represented here one at a time, but the opportunity to work with seven other nations simultaneously in the service of improving cyberdefense is truly an opportunity that I cannot overstate,” he told reporters Tuesday during a tour of the exercise.
U.S. Air Force airmen discuss cybersecurity during a drill as part of Cobra Gold in Nong Phai Lom, Thailand, on March 4, 2025. (Alex Wilson/Stars and Stripes)
Cobra Gold, a multi-faceted exercise with approximately 30 countries represented, began Feb. 25 and concluded Friday.
The cyberwarfare scenario depicted a fictional conflict between several imaginary countries, with a complex series of events that coupled traditional warfare involving warships, aircraft and troops with a digital domain.
Van Zandt repeatedly emphasized that the exercise was exclusively focused on defensive techniques and the drill was not tailored to “any specific group, real world, fictional or otherwise.”
Instead, participants were practicing for the most common of digital threats, such as malware — software used to steal data or otherwise harm individuals or companies — and people who use basic scripts to exploit weaknesses in programs or computers, also known as a “script kiddie.”
“If all it takes to affect critical infrastructure or something very mission essential is something that doesn’t rise beyond the level of a script kiddie, then that’s what these teams and what we need to help train and defend against,” he told Stars and Stripes after the tour.
Robert Godec, U.S. ambassador to Thailand, listens to experts discuss an ongoing simulated exercise as part of Cobra Gold in Nong Phai Lom, Thailand, on March 4, 2025. (Alex Wilson/Stars and Stripes)
Federal agencies in fiscal year 2022 reported more than 30,000 information technology-related incidents, representing potentially serious harm to “human safety, national security, the environment and the economy,” according to a June 2024 report from the U.S. Government Accountability Office.
“Cyber, of course, is a domain that reaches across all other domains,” Van Zandt said. “And so inevitably, cyberdefense is vastly important to ensure that these campaigns are able to succeed properly.”
Robert Godec, U.S. ambassador to Thailand, said internet security, drone and space warfare are the “emerging challenges.”
“I think we need to be prepared and really work together in those areas,” he told Stars and Stripes at the exercise. “That just ensures, again, that we can do what we need to do to help keep Americans safe and help keep Thais safe and just generally people in this region.”
