Cyber Yankee 2026

Cybersecurity Practitioner and Elected Official to Lead Red Team at Cyber Yankee 2026

13-year Army veteran will build nation-state attack scenarios for the DOD’s largest regional cyber defense exercise while foreign nation-state threats to U.S. infrastructure remain active

TEWKSBURY, MA, April 29th, 2026

James F. Mackey III will serve as cyber threat emulation lead for Cyber Yankee 2026, the National Guard’s annual exercise where 400+ military, government, and private-sector participants train to defend New England’s power grids, water systems, and utility networks from simulated nation-state cyberattacks.

The exercise takes place in May at Camp Nett in Niantic, Connecticut. Mackey will design and execute the adversary scenarios that opposing teams defend against over two weeks.

This year’s exercise comes as foreign nation-state cyber retaliation against U.S. private-sector companies remains a concern following military escalations, and CISA continues to warn that the cyber actor Volt Typhoon is pre-positioned inside U.S. critical infrastructure. Mackey published a sourced analysis of cyber operations targeting U.S. companies earlier this year. Last year’s Cyber Yankee was the first to include a direct threat briefing from a company compromised by Volt Typhoon.

Mackey is a 13-year U.S. Army veteran (Operation Enduring Freedom), CISSP-certified cybersecurity practitioner, and sits on the Tewksbury, MA Select Board. He founded the Municipal Cyber Association, a nonprofit that helps towns and cities build cybersecurity programs, and secured $250,000 in cybersecurity grants for his town’s infrastructure. He was featured on NBC Boston in April 2026 regarding security policy at Tewksbury Hospital.

Cyber Yankee, now in its 12th year, is the only DOD cyber exercise focused on civilian critical infrastructure rather than military networks. The 2025 edition drew nearly 400 participants from seven states, the Marine Corps, Coast Guard, Space Force, CISA, Department of Energy, and international partners from ten countries.

About Cyber Yankee

Cyber Yankee is the National Guard’s annual tactical-level Defensive Cyber Operations (DCO) exercise focused on the New England region. It evaluates a whole-of-government response to significant cyber incidents involving critical infrastructure.

The exercise is unique among DoD cyber exercises because it focuses on civilian critical infrastructure (power grids, water systems, gas pipelines) rather than military networks, and integrates private-sector utility companies as active participants alongside military defenders.

Founded: 2015. Started with 89 soldiers in two classrooms. Now 400+ participants over two weeks.

Format: Two-week exercise. Week 1 is training and certification. Week 2 is force-on-force operations on the DOD’s Persistent Cyber Training Environment (PCTE), an unclassified cyber range.

Teams: Blue Teams (4-5 joint/multinational teams) defend simulated utility networks. Red Team designs and executes adversary scenarios using real-world, open-source tactics, techniques, and procedures. White Team regulates and assesses. Role-players act as corporate CIOs and IT staff for realism.

Scenario: Unattributed cyberattacks on fictional utilities across New England. State governors activate the National Guard to respond. Participants rehearse the coordination between military cyber units, federal agencies, and private-sector infrastructure operators.

Classification: Intentionally unclassified to enable participation by civilian utility companies and international military partners.

Exercise History

The exercise rotates annually among New England states.

2015: Founded. 89 soldiers, two classrooms, one week.

2022: Camp Nett, Niantic, CT. June 5-18.

2023: Camp Nett, Niantic, CT. May 14-28. Marine Corps provided Red Team support. SANS Capture the Flag competition. Introduction of ICS Village (3D interactive model showing physical effects of cyberattacks on infrastructure).

2024: Joint Base Cape Cod, MA. May 6-17. 250+ participants. 10th anniversary. First year with international partners: Bahamas, Cyprus, El Salvador, Israel, Japan, Kenya, Latvia, Montenegro, Paraguay, Uruguay. Integration of Cyber 9-Line tool with U.S. Cyber Command. Lt. Gen. Maria Barrett (ARCYBER Commander) attended DV Day.

2025: Edward Cross Training Complex, Pembroke, NH. May 5-16. 330-400 participants: 240 military, 20 government, 35 private sector, 40 international. First direct threat briefing from a Volt Typhoon victim company. Salvadoran Army cyber operators embedded on Blue Teams alongside NH and VT Guard members. Gov. Kelly Ayotte briefed by cyber operators.

2026: Camp Nett, Niantic, CT. May 2026. James Mackey confirmed as cyber threat emulation lead.

Past Participants

National Guard cyber units from: Connecticut, Maine, Massachusetts, New Hampshire, New Jersey, Rhode Island, Vermont.

U.S. Military: Marine Corps (DCO-IDM Companies, 6th Comm Bn), Coast Guard (1790 Cyber Protection Team), Space Force (65th Cyberspace Squadron), Air Force Reserve (439th Airlift Wing), Army Cyber Command.

Federal government: CISA, Department of Energy, Defense Counterintelligence and Security Agency, Federal Energy Regulatory Commission, U.S. Cyber Command.

Private sector: Avangrid, Eversource, ISO New England, National Grid, Massachusetts Water Resource Authority, The Metropolitan District, Unitil, Dragos.

Threat Context

Cyberattacks on U.S. critical infrastructure have increased in frequency and severity.

Volt Typhoon: Foreign state-sponsored cyber actor confirmed by CISA and multiple intelligence agencies to be pre-positioned inside U.S. critical infrastructure networks, including energy and water systems. Cyber Yankee 2025 included the first direct threat briefing from a Volt Typhoon victim.

Recent incidents: Colonial Pipeline ransomware (2021), JBS ransomware (2021), Bradley International Airport DDoS (2022), City of Lowell MA ransomware (2023).

Workforce gap: Approximately 700,000 unfilled cybersecurity positions in the United States. Most municipalities and small utilities lack dedicated cybersecurity staff.

Coverage Archive

DefenseScoop: “Army Cyber Command taking key lessons on critical infrastructure defense at National Guard exercise” (May 2024) “National Guardsmen receive brief from Volt Typhoon utility victim at cyber exercise” (May 2025)

FedScoop: “Cyber Yankee exercise helps National Guard mature partnership with Cyber Command” (July 2022)

C4ISRNet: “Cyber Yankee exercise hones New England Guard skills to fight digital threats” (2022)

Army.mil: “Cyber Yankee prepares DoD, government, and business for potential cyber threats” (June 2023) “New Hampshire Army National Guard Hosts 2025 Cyber Yankee Training Exercise” (May 2025)

DVIDS: “10 Years of Cyber Yankee” (May 2024)

The Cyber Defense Review: “Voices from Cyber Yankee: Lessons for Strengthening…” (November 2025)

Marines.mil: “Cyber Yankee 23” (June 2023)

Cyber Yankee