Specialized Cyber Red Team Responsive Computer Network Operations

Blumbergs, Bernhards

Cyber Mindfulness

Computer g33k since the age of 0x0A. Res3arch1ng, build1ng, d3str0ying, and fixing cyb3rsp4ce to find the meaning beyond byt3s

Dr. Bernhards Blumbergs is a lead cybersecurity expert at the Information Technology Security Incident Response Institution of the Republic of Latvia (CERT.LV) with responsibilities focusing on national operational technology active cyber defence. Former Technology branch researcher at the NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) and a long term ambassador of the Centre. He is the creator and former technical director of the innovative full-spectrum offensive cyber operation exercise Crossed Swords. He holds multiple renowned certifications in hacking, penetration testing, exploit development, and industrial control system security. He has a strong military background, a cyber-physical operational security practical mindset, and is a trained tactical leader for uncrewed vehicle teams. Dr. Blumbergs received his Computer Science PhD degree in Cyber Security from Tallinn Technical University (TalTech), with his dissertation on specialised cyber red team responsive computer network operations. He completed a JSPS postdoc fellowship at the Nara Institute of Science and Technology (Japan), with his research focusing on cyber threat intelligence data mining and analysis.

ORCID: 0000-0001-9679-6282

Academic Impact: 118+ citations · h-index: 6 Semantic Scholar ↗

Research Activity Timeline 13 Years (2014–2026) · 23 Publications

Click a year to filter

23 publications

[1]

H. Skrodelis, A. Romanovs, and B. Blumbergs, "A workload-aware deployment evaluation of IEC 60870-5-104 intrusion detection at an energy operator", International Journal of Critical Infrastructure Protection, Oct. 2026, p. 100905, doi: 10.1016/j.ijcip.2026.100905. PDF DOI ScienceDirect ResearchGate 0 citations

@article{skrodelis2026workload,
  author    = {Skrodelis, Heinrihs and Romanovs, Andrejs and Blumbergs, Bernhards},
  title     = {A workload-aware deployment evaluation of {IEC} 60870-5-104 intrusion detection at an energy operator},
  journal   = {International Journal of Critical Infrastructure Protection},
  month     = {Oct},
  year      = {2026},
  pages     = {100905},
  doi       = {10.1016/j.ijcip.2026.100905}
}

[2]

M. Potapovs, K. Teters, J. Frīdmanis, and B. Blumbergs, "Evaluating National CSIRT Maturity: The Case of CERT.LV", in Cybersecurity in Latvia: Forging Resilience amidst Emerging Threats, M. Potapovs and K. E. Kanasta, Eds. London, UK: Routledge, 2026, ch. 4, pp. 52–73, doi: 10.4324/9781003638858. PDF DOI 0 citations

@incollection{potapovs2026evaluating,
  author    = {Potapovs, M. and Teters, K. and Fr{\=i}dmanis, J. and Blumbergs, B.},
  title     = {Evaluating National {CSIRT} Maturity: The Case of {CERT.LV}},
  booktitle = {Cybersecurity in Latvia: Forging Resilience amidst Emerging Threats},
  editor    = {Potapovs, M. and Kanasta, K. E.},
  publisher = {Routledge},
  address   = {London, UK},
  chapter   = {4},
  pages     = {52--73},
  year      = {2026},
  doi       = {10.4324/9781003638858}
}

[3]

B. Blumbergs, "How nations build and defend their cyberspace capabilities", Help Net Security, Nov. 2025. PDF 0 citations

@article{blumbergs2025nations,
  author    = {Blumbergs, Bernhards},
  title     = {How nations build and defend their cyberspace capabilities},
  journal   = {Help Net Security},
  month     = {Nov},
  year      = {2025}
}

[4]

H. K. Skrodelis, B. Blumbergs, and A. Romanovs, "Threat Scenario Generation for IEC104 Cyber Defense", in Proc. 2024 IEEE Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE), Riga, Latvia, 2024, pp. 1–8, doi: 10.37394/23203.2026.21.5. PDF DOI 2 citations

@inproceedings{skrodelis2024threat,
  author    = {Skrodelis, H. K. and Blumbergs, B. and Romanovs, A.},
  title     = {Threat Scenario Generation for {IEC104} Cyber Defense},
  booktitle = {Proc. 2024 IEEE Workshop on Advances in Information, Electronic and Electrical Engineering (AIEEE)},
  address   = {Riga, Latvia},
  pages     = {1--8},
  year      = {2024},
  doi       = {10.37394/23203.2026.21.5}
}

[5]

B. Blumbergs, "Black Sheep Wall: Towards Multiple Vantage Point-based Information Space Situational Awareness", in Proc. 21st Int. Conf. Security and Cryptography (SECRYPT 2024), SciTePress, Dijon, France, 2024, pp. 641–652, doi: 10.5220/0012709600003767. PDF DOI 0 citations

@inproceedings{blumbergs2024blacksheepwall,
  author    = {Blumbergs, Bernhards},
  title     = {Black Sheep Wall: Towards Multiple Vantage Point-based Information Space Situational Awareness},
  booktitle = {Proc. 21st Int. Conf. Security and Cryptography (SECRYPT 2024)},
  publisher = {SciTePress},
  address   = {Dijon, France},
  pages     = {641--652},
  year      = {2024},
  doi       = {10.5220/0012709600003767}
}

[6]

B. Blumbergs, "Black Sheep Wall: Clearing the Fog-of-War for Cyber Intelligence Collection", CERT.LV Research Report / Whitepaper, Apr. 2024. PDF 0 citations

@techreport{blumbergs2024bsw_report,
  author      = {Blumbergs, Bernhards},
  title       = {Black Sheep Wall: Clearing the Fog-of-War for Cyber Intelligence Collection},
  institution = {CERT.LV},
  month       = {Apr},
  year        = {2024}
}

[7]
B. Blumbergs, "A Multiple Vantage Point-based Concept for Open-Source Information Space Awareness", in Information and Communication System Security (ICSS) Technical Workshop, IEICE Technical Report, vol. 123, no. 14, ICSS2023-1, Sapporo, Japan, May 2023, pp. 1–6. PDF 0 citations
```
@article{blumbergs2023bswarm,
  author  = {Blumbergs, Bernhards},
  title   = {A Multiple Vantage Point-based Concept for Open-Source Information Space Awareness},
  journal = {IEICE Technical Report},
  volume  = {123},
  number  = {14},
  pages   = {1--6},
  year    = {2023}
}
```

[8]

B. Blumbergs, Ē. Dobelis, P. Paikens, K. Nesenbergs, K. Solovjovs, and A. Rušiņš, "WearSec: Towards Automated Security Evaluation of Wireless Wearable Devices", in Secure IT Systems (NordSec 2022), Lecture Notes in Computer Science, vol. 13700, Cham: Springer, 2022, pp. 311–325, doi: 10.1007/978-3-031-22295-5_17. PDF DOI 1 citation

@inproceedings{blumbergs2022wearsec,
  author    = {Blumbergs, B. and Dobelis, {\=E}. and Paikens, P. and Nesenbergs, K. and Solovjovs, K. and Ru{\v{s}}i{\c{n}}{\v{s}}, A.},
  title     = {{WearSec}: Towards Automated Security Evaluation of Wireless Wearable Devices},
  booktitle = {Secure IT Systems (NordSec 2022)},
  series    = {Lecture Notes in Computer Science},
  volume    = {13700},
  publisher = {Springer},
  pages     = {311--325},
  year      = {2022},
  doi       = {10.1007/978-3-031-22295-5_17}
}

[9]

A. Uljāns and B. Blumbergs, "Industrial and Automation Control System Cyber Range Prototype for Offensive Capability Development", in Proc. 8th Int. Conf. Information Systems Security and Privacy (ICISSP 2022), SciTePress, 2022, pp. 478–490, doi: 10.5220/0010879500003120. PDF DOI 0 citations

@inproceedings{uljans2022iacs,
  author    = {Ulj{\=a}ns, A. and Blumbergs, B.},
  title     = {Industrial and Automation Control System Cyber Range Prototype for Offensive Capability Development},
  booktitle = {Proc. 8th Int. Conf. Information Systems Security and Privacy (ICISSP 2022)},
  publisher = {SciTePress},
  pages     = {478--490},
  year      = {2022},
  doi       = {10.5220/0010879500003120}
}

[10]

B. Blumbergs, "Specialized Cyber Red Team Responsive Computer Network Operations", Ph.D. dissertation, Dept. Software Science, School of Information Technologies, Tallinn Univ. of Technology, Tallinn, Estonia, Thesis 25/2019, 2019. PDF 0 citations

@phdthesis{blumbergs2019dissertation,
  author  = {Blumbergs, Bernhards},
  title   = {Specialized Cyber Red Team Responsive Computer Network Operations},
  school  = {Tallinn University of Technology},
  address = {Tallinn, Estonia},
  year    = {2019},
  note    = {Thesis 25/2019}
}

[11]

B. Blumbergs, R. Ottis, and R. Vaarandi, "Crossed Swords: A Cyber Red Team Oriented Technical Exercise", in Proc. 18th Eur. Conf. Cyber Warfare and Security (ECCWS 2019), Coimbra, Portugal, Jul. 2019, pp. 37–44. PDF 0 citations

@inproceedings{blumbergs2019crossedswords,
  author    = {Blumbergs, B. and Ottis, R. and Vaarandi, R.},
  title     = {Crossed Swords: A Cyber Red Team Oriented Technical Exercise},
  booktitle = {Proc. 18th Eur. Conf. Cyber Warfare and Security (ECCWS 2019)},
  address   = {Coimbra, Portugal},
  pages     = {37--44},
  year      = {2019}
}

[12]

B. Blumbergs, "Remote Exploit Development for Cyber Red Team Computer Network Operations Targeting Industrial Control Systems", in Proc. 5th Int. Conf. Information Systems Security and Privacy (ICISSP 2019), Prague, Czech Republic, vol. 1, Feb. 2019, pp. 88–99, doi: 10.5220/0007310300880099. PDF DOI 4 citations

@inproceedings{blumbergs2019remoteexploit,
  author    = {Blumbergs, Bernhards},
  title     = {Remote Exploit Development for Cyber Red Team Computer Network Operations Targeting Industrial Control Systems},
  booktitle = {Proc. 5th Int. Conf. Information Systems Security and Privacy (ICISSP 2019)},
  volume    = {1},
  address   = {Prague, Czech Republic},
  pages     = {88--99},
  year      = {2019},
  doi       = {10.5220/0007310300880099}
}

[13]

D. Mucci and B. Blumbergs, "TED: A Container based Tool to Perform Security Risk Assessment for ELF Binaries", in Proc. 5th Int. Conf. Information Systems Security and Privacy (ICISSP 2019), Prague, Czech Republic, vol. 1, Feb. 2019, pp. 361–369, doi: 10.5220/0007371603610369. PDF DOI 2 citations

@inproceedings{mucci2019ted,
  author    = {Mucci, D. and Blumbergs, B.},
  title     = {{TED}: A Container based Tool to Perform Security Risk Assessment for {ELF} Binaries},
  booktitle = {Proc. 5th Int. Conf. Information Systems Security and Privacy (ICISSP 2019)},
  volume    = {1},
  address   = {Prague, Czech Republic},
  pages     = {361--369},
  year      = {2019},
  doi       = {10.5220/0007371603610369}
}

[14]

R. Vaarandi, B. Blumbergs, and M. Kont, "An Unsupervised Framework for Detecting Anomalous Messages from Syslog Log Files", in 2018 IEEE/IFIP Network Operations and Management Symposium (NOMS 2018), Taipei, Taiwan, Apr. 2018, pp. 1–6, doi: 10.1109/NOMS.2018.8406283. PDF DOI 33 citations

@inproceedings{vaarandi2018unsupervised,
  author    = {Vaarandi, R. and Blumbergs, B. and Kont, M.},
  title     = {An Unsupervised Framework for Detecting Anomalous Messages from Syslog Log Files},
  booktitle = {2018 IEEE/IFIP Network Operations and Management Symposium (NOMS 2018)},
  address   = {Taipei, Taiwan},
  pages     = {1--6},
  year      = {2018},
  doi       = {10.1109/NOMS.2018.8406283}
}

[15]

B. Blumbergs and R. Vaarandi, "Bbuzz: A Bit-aware Fuzzing Framework for Network Protocol Systematic Reverse Engineering and Analysis", in 2017 IEEE Military Communications Conference (MILCOM 2017), Baltimore, MD, USA, Oct. 2017, pp. 707–712, doi: 10.1109/MILCOM.2017.8170785. PDF DOI 21 citations

@inproceedings{blumbergs2017bbuzz,
  author    = {Blumbergs, B. and Vaarandi, R.},
  title     = {Bbuzz: A Bit-aware Fuzzing Framework for Network Protocol Systematic Reverse Engineering and Analysis},
  booktitle = {2017 IEEE Military Communications Conference (MILCOM 2017)},
  address   = {Baltimore, MD, USA},
  pages     = {707--712},
  year      = {2017},
  doi       = {10.1109/MILCOM.2017.8170785}
}

[16]

M. Kont, M. Pihelgas, K. Maennel, B. Blumbergs, and T. Lepik, "Frankenstack: Toward Real-time Red Team Feedback", in 2017 IEEE Military Communications Conference (MILCOM 2017), Baltimore, MD, USA, Oct. 2017, pp. 400–405, doi: 10.1109/MILCOM.2017.8170852. PDF DOI 11 citations

@inproceedings{kont2017frankenstack,
  author    = {Kont, M. and Pihelgas, M. and Maennel, K. and Blumbergs, B. and Lepik, T.},
  title     = {Frankenstack: Toward Real-time Red Team Feedback},
  booktitle = {2017 IEEE Military Communications Conference (MILCOM 2017)},
  address   = {Baltimore, MD, USA},
  pages     = {400--405},
  year      = {2017},
  doi       = {10.1109/MILCOM.2017.8170852}
}

[17]

A. Farar, H. Bahsi, and B. Blumbergs, "A Case Study About the Use and Evaluation of Cyber Deceptive Methods Against Highly Targeted Attacks", in 2017 Int. Conf. on Cyber Incident Response, Coordination, Containment & Control (Cyber Incident 2017), London, UK, Jun. 2017, pp. 1–7, doi: 10.1109/CYBERINCIDENT.2017.8054640. PDF DOI 5 citations

@inproceedings{farar2017deception,
  author    = {Farar, A. and Bahsi, H. and Blumbergs, B.},
  title     = {A Case Study About the Use and Evaluation of Cyber Deceptive Methods Against Highly Targeted Attacks},
  booktitle = {2017 Int. Conf. on Cyber Incident Response, Coordination, Containment \& Control (Cyber Incident 2017)},
  address   = {London, UK},
  pages     = {1--7},
  year      = {2017},
  doi       = {10.1109/CYBERINCIDENT.2017.8054640}
}

[18]

B. Blumbergs, M. Pihelgas, M. Kont, O. Maennel, and R. Vaarandi, "IPv6 Vulnerability", Intelligence Notification No. 7/2017, Series: Trend CYBER BITS, The Hague, Netherlands, Apr. 2017. PDF 0 citations

@techreport{blumbergs2017ipv6notification,
  author      = {Blumbergs, B. and Pihelgas, M. and Kont, M. and Maennel, O. and Vaarandi, R.},
  title       = {{IPv6} Vulnerability},
  institution = {Trend CYBER BITS},
  number      = {7/2017},
  address     = {The Hague, Netherlands},
  year        = {2017}
}

[19]

M. N. Schmitt, Ed., "Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations", Cambridge, UK: Cambridge University Press, 2017 (Leading Technical Expert and Reviewer: B. Blumbergs). PDF 0 citations

@book{schmitt2017tallinn2,
  editor    = {Schmitt, Michael N.},
  title     = {Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations},
  publisher = {Cambridge University Press},
  address   = {Cambridge, UK},
  year      = {2017},
  note      = {Leading Technical Expert and Reviewer: B. Blumbergs}
}

[20]

B. Blumbergs, M. Pihelgas, M. Kont, O. M. Maennel, and R. Vaarandi, "Creating and Detecting IPv6 Transition Mechanism-Based Information Exfiltration Covert Channels", in Secure IT Systems (NordSec 2016), Lecture Notes in Computer Science, vol. 10014, Cham: Springer, 2016, pp. 85–100, doi: 10.1007/978-3-319-47560-8_6. PDF DOI 16 citations

@inproceedings{blumbergs2016covert,
  author    = {Blumbergs, B. and Pihelgas, M. and Kont, M. and Maennel, O. M. and Vaarandi, R.},
  title     = {Creating and Detecting {IPv6} Transition Mechanism-Based Information Exfiltration Covert Channels},
  booktitle = {Secure IT Systems (NordSec 2016)},
  series    = {Lecture Notes in Computer Science},
  volume    = {10014},
  publisher = {Springer},
  pages     = {85--100},
  year      = {2016},
  doi       = {10.1007/978-3-319-47560-8_6}
}

[21]

R. Vaarandi, B. Blumbergs, and E. Çalışkan, "Simple Event Correlator - Best Practices for Creating Scalable Configurations", in 2015 IEEE Int. Multi-Disciplinary Conf. on Cognitive Methods in Situation Awareness and Decision (CogSIMA 2015), Orlando, FL, USA, Mar. 2015, pp. 96–100, doi: 10.1109/COGSIMA.2015.7108181. PDF DOI 17 citations

@inproceedings{vaarandi2015sec,
  author    = {Vaarandi, R. and Blumbergs, B. and {\c{C}}al{\i}{\c{s}}kan, E.},
  title     = {Simple Event Correlator - Best Practices for Creating Scalable Configurations},
  booktitle = {2015 IEEE Int. Multi-Disciplinary Conf. on Cognitive Methods in Situation Awareness and Decision (CogSIMA 2015)},
  address   = {Orlando, FL, USA},
  pages     = {96--100},
  year      = {2015},
  doi       = {10.1109/COGSIMA.2015.7108181}
}

[22]

B. Blumbergs, P. Brangetto, L. Lindström, M. Maybaum, A.-M. Osula, M. N. Pissanidis, H. Rõigas, M. Veenendaal, and T. U. Väisänen, "Introduction", in 2015 7th Int. Conf. on Cyber Conflict (CyCon 2015): Architectures in Cyberspace, Tallinn, Estonia, May 2015, pp. 1–4, doi: 10.1109/CYCON.2015.7158463. DOI 1 citation

@inproceedings{blumbergs2015cycon,
  author    = {Blumbergs, B. and Brangetto, P. and Lindstr{\"o}m, L. and Maybaum, M. and Osula, A.-M. and Pissanidis, M. N. and R{\~o}igas, H. and Veenendaal, M. and V{\"a}is{\"a}nen, T. U.},
  title     = {Introduction},
  booktitle = {2015 7th Int. Conf. on Cyber Conflict (CyCon 2015): Architectures in Cyberspace},
  address   = {Tallinn, Estonia},
  pages     = {1--4},
  year      = {2015},
  doi       = {10.1109/CYCON.2015.7158463}
}

[23]

B. Blumbergs, "Technical Analysis of Advanced Threat Tactics Targeting Critical Information Infrastructure", CERT.LV / CCDCOE Technical Report, Riga, Latvia, 2014. PDF 5 citations

@techreport{blumbergs2014cii,
  author      = {Blumbergs, Bernhards},
  title       = {Technical Analysis of Advanced Threat Tactics Targeting Critical Information Infrastructure},
  institution = {CERT.LV / NATO CCDCOE},
  address     = {Riga, Latvia},
  year        = {2014}
}

Contact me over Session:

051e5784e976696212151be42adbfbccd7085f0c7a590e37243e3d7bc41283fd4c

0 or g g	Top of page
1	Jump to [1] Bio
2	Jump to [2] Publications
3	Jump to [3] Contact
j / k	Scroll down / up
G	Jump to bottom
n / p	Next / previous publication
b	Toggle BibTeX on active publication
o	Open link / PDF on active publication
f	Cycle category filter (All, ICS, NATO, etc.)
/	Search publications
s	Copy Session Messenger ID
t	Toggle theme
c	Color scheme
a	Font size
?	Keybindings
Esc	Close modal, clear search, or reset active item