Hackathon against real critical-infrastructure attacks
On 29 October in Madrid, THE SIGN 2.0 Hackathon: CASCADE Critical Infrastructure CTF teaches the defenders of energy, water, transport and public services how to protect and resist.
Energy grids, water systems, transport networks and public services run on technology that was built to be reliable, not to resist attackers. The pressure on them is already visible in the data:
- ENISA's 2025 Threat Landscape looked at 4,875 incidents across Europe between July 2024 and June 2025. More than half of them (53.7%) hit essential entities as defined by NIS2. Source: ENISA Threat Landscape 2025.
- DDoS made up 77% of reported incidents, and ransomware was the most damaging threat in the EU. Most of the volume came from low-impact hacktivist campaigns, and only 2% of incidents disrupted a service. Source: ENISA Threat Landscape 2025, Industrial Cyber.
- Transport came second among targeted sectors, with 7.5% of incidents. ENISA says it has been in the top five for two years. Source: Industrial Cyber, ENISA, Cyber Europe 2026.
- ENISA names the Z-Pentest-Alliance hacktivist group as a leading threat to EU critical infrastructure. It focuses on energy, and on internet-exposed OT management interfaces in energy and water. Source: DeNexus summary of ENISA 2025.
- Threat intelligence firm EclecticIQ reports that physical sabotage operations have quadrupled since 2024, with more than 150 hybrid-warfare incidents across the EU and NATO.
- On 24 September 2026, E.ON CEO Leonhard Birnbaum said attacks on his company's grids are increasing significantly, both physical and cyber. E.ON has 2,720 substations, he noted, and cannot put guards at every one. Source: Claims Journal.
Defenders can't count on stopping every attack. They need to be ready to respond, and that only comes with practice, which the people running these systems rarely get under realistic pressure. On 29 October, THE SIGN 2.0 Hackathon: CASCADE Critical Infrastructure CTF teaches them how to protect and resist.
What the day looks like
CASCADE is a full-day exercise in Madrid covering energy, water, transport and public services. Results are measured against the NIST NICE framework, with an assessment before and after the event, so you get a documented picture of skills and not just a scoreboard. Teams of four to five compete on a live leaderboard, with challenges ranging from warm-up level to expert.
Who designed the exercise
The architect of the hackathon is Unit Range, the cyber resilience platform of Cyber Unit Technologies. The company has been a backbone of Ukraine's cyber resilience since 2022, and its clients include the National Bank of Ukraine, the Ministry of Foreign Affairs, Kyivstar, PrivatBank and the Defence Procurement Agency.
- It reports 30+ national-scale projects, and works with 120 critical-infrastructure organisations from 8+ industries in 2025.
- Its programmes and CTF-style exercises have trained and simulated incident response for 2,000+ government and private-sector specialists.
The scenarios for THE SIGN 2.0 Hackathon: CASCADE Critical Infrastructure CTF come from attacks observed against critical infrastructure in Eastern Europe, the most heavily targeted environment in Europe. Participants work with real malware behaviour, protocol traffic and intrusion paths. Operators, facilities and geographies are anonymised.
The technical leads
Kirill Y., Security Lead, CyberUnit Technologies
Gabriel González, Senior Security Consultant at IOActive, with 25+ years in embedded systems security, reverse engineering, vulnerability analysis of embedded systems and smart meters, and black-box testing of application software.
Manuel García Cortés, Researcher and Educator at the University of Salamanca, specialising in quantum cryptography.
Pablo Asenjo, President and Co-founder of the Spanish Space Initiative (SPSIN) and a Computer Engineering student at Oxford Brookes University. SPSIN was founded by the group that won the International Space Settlement Design Competition (ISSDC) in 2023, and it organises the Spanish Space Design Competition. In 2025 it mentored nine students who represented Spain at the ISSDC final at Kennedy Space Center.
How to join the hackathon
Participants are selected through an application form that takes about three minutes: https://www.eventbrite.es/e/entradas-the-sign-20-hackathon-cascade-critical-infrastructure-ctf-1993527994897 Deadline for applications — October 9, 2026.
Organisers and partners
The hackathon is organised by Unit Range (Cyber Unit Technologies) together with THE SIGN.MEDIA and RCC.Advisory. It is supported by the Agency of Cybersecurity of the Community of Madrid and the Spanish Space Agency. The ecosystem partner is the European Defense Tech Hub.