Hunt-forward missions are conducted by the Cyber National Mission Force. The CNMF has previously worked in Ukraine, Albania and Latvia.

According to the head of Cyber Command and the National Security Agency, American cyber experts labored in over a dozen nations last year as part of an effort to strengthen networks and reveal hacker capabilities.

Air Force Gen. Timothy Haugh said before the Senate Armed Services Committee on April 10 that the so-called hunt-forward missions, carried out by CYBERCOM’s elite Cyber National Mission Force, or CNMF, totaled 22 deployments, with some occurring concurrently throughout the globe.

“Enhancing the security of government, private sector and critical infrastructure systems grows ever more imperative,” said Haugh, who took the helm at CYBERCOM and NSA in February. “Foreign adversaries continuously update how they operate, and frequently work through American-owned networks and devices.”

Hunt-forward missions are executed at the invitation of a foreign government and are not always disclosed. They’re part of CYBERCOM’s persistent engagement strategy — a means of being in constant contact with adversaries and ensuring proactive, not reactive, moves are made.

Haugh’s disclosure offers a rare look at the CNMF workload, which is often nebulous, as some countries prefer to keep quiet the digital cooperation.

The mission force has in the past worked with Ukraine, ahead of Russia’s invasion; Albania, on the heels of Iranian cyberattacks; and Latvia, where malware was unearthed. Other previous deployments included Estonia, Croatia, Lithuania, Montenegro and North Macedonia.

The Defense Department sought $14.5 billion for cyber activities in fiscal 2025. The figure is about $1 billion more than the Biden administration’s previous ask. It is also up from FY23, when it sought $11.2 billion.

“We work every day against capable and determined cyber actors, many of them serving adversary military and intelligence services,” Haugh said. “Our operational experience reinforces the importance of campaigning globally in and through cyberspace across the conditions of competition, crisis and armed conflict.”