VCU team earns award from U.S. Cyber Command for critical infrastructure research

By VCU College of Engineering staff

A Virginia Commonwealth University cybersecurity research team is earning national recognition for tackling one of the biggest challenges facing critical infrastructure: protecting the industrial computers that keep essential systems running.

The team recently received the U.S. Cyber Command Hunter Award for its project, MEMWAR: Controller Memory Exploitation and Weaponization in Critical Infrastructure.

Rear Admiral Kevin Lenox, chief of staff at USCYBERCOM, presented the award at the Defense Information School in April during CyberRECon 2026, the Cyber Research and Education Conference and the flagship program of USCYBERCOM’s Office of Academic Engagements. CyberRECon brings together universities and Department of Defense mentors to tackle real-world cybersecurity challenges, giving students the opportunity to develop research with direct national security applications.

Developed in VCU’s Security and Forensics Engineering (SAFE) Lab, MEMWAR focused on understanding and protecting programmable logic controllers, or PLCs. These are specialized industrial computers that control physical processes in industries such as manufacturing, power generation, transportation and water treatment. Because PLCs operate these essential systems, protecting them is critical.

Postdoctoral researcher Wooyeon Jo and Ph.D. students Badreddin Alhabbal, Muhammad Shaharyar Yaqub, Yahya Forihat and Nehal Ameen comprised the team, with Irfan Ahmed, Ph.D., Engineering Foundation Professor and director of VCU’s SAFE Lab, serving as faculty mentor. Department of Defense mentor Robert Landreth also worked alongside the team to guide and connect the research to real-world national security challenges.

For Alhabbal, this experience reinforced the importance of staying curious when research doesn’t go as planned.

“In cybersecurity, especially when working with real hardware and industrial systems, an experiment that does not work the way you expected is not necessarily a failure,” Alhabbal said. “Sometimes that unexpected behavior becomes the most interesting part of the research because it forces you to ask a better question.”

That mindset also extended to the team’s writing and research process. Jo said working through feedback helped the group become more efficient as the project progressed.

“At first, the same points needed to be repeated to the point of feeling redundant, but over time everyone’s pace in writing, revising and understanding the comments accelerated,” Jo said.

For Forihat, presenting the team’s research at CyberRECon made the national recognition even more meaningful.

“It was an honor to be part of the team and to see our work receive the Hunter Award,” Forihat said. “Presenting at CyberRECon was already a great opportunity, but having the research recognized by the U.S. Cyber Command made the experience even more special. It was a proud moment for me and a reminder that the work we are doing can have a real impact.”

The team investigated how attackers could target PLC memory and misuse legitimate engineering features to disrupt operations at the controller level. While much of cybersecurity focuses on protecting networks and software, MEMWAR explored vulnerabilities inside the controllers themselves, helping researchers better understand how to defend critical infrastructure before those attacks become reality.

“Our work looks at the controller as a critical security boundary,” Ahmed said. “If adversaries can manipulate or disrupt the controller, they can affect the physical process itself. Understanding these risks is essential for protecting critical infrastructure.”

Bringing the project to life required months of careful experimentation. Programmable logic controllers are designed for reliability, and their internal memory structures are often proprietary and difficult to analyze. The team developed safe, repeatable methods to test real industrial controllers while validating their findings across multiple platforms.

“This was a difficult research problem involving real industrial equipment, proprietary systems and safety-sensitive experimentation,” Ahmed said. “Seeing the students present their work to a national security audience and receive recognition from U.S. Cyber Command leadership was a very proud moment.”

The Hunter Award is the first of its kind for VCU and builds on the university’s growing record of recognition from USCYBERCOM, including the Commander’s Award and Guardian Award in 2024 and the Defender Award in 2025.

For students in the SAFE Lab, awards like these represent more than national recognition. They reflect the opportunity to work alongside faculty and federal partners, apply classroom knowledge to real-world cybersecurity challenges and conduct research that helps protect the systems millions of people rely on every day. It is the kind of hands-on experience that prepares VCU engineering students to make an impact long before they graduate.

This story was originally published on the College of Engineering website.