Yesterday, we wrapped up “We just got hacked”, a basic three-day technical training on incident response for entry level system administrators and cybersecurity specialists from regional public institutions to work through what happens after a security alert becomes a real incident: how to triage it, identify what matters first, analyse logs, trace the likely attack vector and examine suspicious files for indicators of compromise. 

Participants worked with the MITRE ATT&CK framework, connecting investigative findings with attacker tactics and techniques, and looking at how those findings can be translated into practical hardening and preventive measures. The objective was not simply to understand how an incident happened, but to use that analysis to reduce the organisation’s exposure to similar attacks in the future. 
The training was delivered by Jakub Bajera and Krzysztof Chudzik from NASK – Naukowa i Akademicka Sieć Komputerowa / Research and Academic Computer Network, Poland. We also thank our funding partners at URSIV, Urad Vlade Republike Slovenije za informacijsko varnost for their continued support to WB3C and to the development of cybersecurity capacities across the Western Balkans.
Certificates are awarded by Jean-Pierre Bonnet, JP BNT, our new WB3C colleague working across cybercrime and cybersecurity.

We are pleased to welcome Jean-Pierre Bonnet, who joins the Western Balkans Cyber Capacity Centre (WB3C) as a trainer working primarily in the field of cybercrime, while also contributing to the Centre’s cybersecurity activities.

Jean-Pierre began his career in the French Gendarmerie, initially serving in a mobile unit responsible for public-order operations and overseas deployments. He later moved into criminal investigations, progressively specialising in cybercrime-related fields and, in his most recent assignment, working on complex investigations across France.

His professional experience includes open-source intelligence (OSINT), digital forensics and Internet investigations, alongside training and knowledge-sharing with partner administrations in France. He is also completing a long-term professional training programme in cybersecurity and governance, further broadening the expertise he brings to WB3C.

At the Centre, Jean-Pierre will work with partners across the Western Balkans to support the development of skills and operational knowledge in cybercrime, while contributing with the wider team to the continued development of WB3C’s activities.

Welcome to the team, Jean-Pierre!

This week at WB3C, we concluded a four-day OSINT – Dark Web training for anti-drug police units, coming from law enforcement units from across the Western Balkans. The course was designed for police officers working in drug units and joining a WB3C training for the first time. 
The focus was practical: how publicly available information can support internet-based investigations, from identifying potential threats and collecting digital evidence to producing actionable intelligence for operational decision-making. 
Over four days, participants worked through the fundamentals of OSINT, evidence preservation, online protection and anonymisation, social-network investigations, investigative checks, the dark web, and structured data-collection planning. Particular attention was given to preserving the integrity of digital evidence and navigating online environments safely and securely. 
The training was delivered by Nicholas Michee from OFAST, France, together with Cyril CORRIAS, WB3C’s cybercrime trainer. Combining specialist anti-drug investigation experience with cybercrime expertise, they guided participants through the technical and investigative aspects of using open-source information and online environments in support of operational work.
Thank you to Nicholas Michee and our partners at OFAST, France, for their cooperation and expertise, and to Cyril Corrias for his contribution to the training. Thank you also to the participating officers for four days of focused practical work and professional exchange.