This month brings something new! For the first time, OUT NOW features side-by-side updates from both the Cyberbit and RangeForce platforms, giving you a full view of everything new across our readiness programs. 

With brand-new Live-Fire Exercises, foundational training courses, and an expanded suite of AI-driven learning modules, November is packed with hands-on experiences designed to sharpen skills across cloud security, identity management, Active Directory, malware analysis, AI safety, and more. 

Let’s jump in and explore what’s new. 

New on the Cyberbit platform

New Live-Fire Exercises 
 
Lambda Role Abuse 

This engaging and demanding Live-Fire Exercise drops trainees into a high-pressure cloud breach scenario, where a single overlooked vulnerability unravels into full data exposure. 

An external attacker scans a public-facing web app, discovers an SSRF in the upload feature, and uses it to access EC2 IMDS and steal temporary instance credentials. With those in hand, they enumerate S3, pull Update-Lambda.ps1 containing elevated lambda_admin keys, and modify the RDSHealthCheck Lambda function to exfiltrate all non-system MySQL schema and table data as JSON. 

Detection kicks off with a CloudTrail alert on unusual credential use, supported by WAF and CloudTrail evidence of S3 and Lambda activity. 

Trainees are expected to trace the attack chain step by step:  

• Identify the SSRF entry point 

• Confirm IMDS credential theft 

• Uncover the hard-coded secrets 

• Verify the Lambda modification and invocation 

• Execute containment and remediation, including session revocation, IP blocking, input validation, and IMDSv2 enforcement. 

RBAC Manipulation 

In this Azure scenario, an attacker gains Remote Code Execution (RCE) on a public-facing web application running within an Azure Web App. Leveraging the Web App’s compromised Managed Identity, the attacker pivots to a connected Azure Function App, utilizing existing permissions to modify one of its scheduled functions.  

The attacker then exploits the Function App’s elevated role to obtain a Shared Access Signature (SAS) token for a Storage Account, subsequently using this access to exfiltrate data stored within the account. Sounds scary, huh? Make sure your defenders are well prepared for this scenario with the newest RBAC Manipulation live-fire! 

New course: Domain Basics 

This brand-new course provides an introduction to Active Directory Domain Services (AD DS), focusing on the essential knowledge required to manage and secure Windows domain environments.  

Trainees will gain foundational skills in core AD architecture, including deploying a Domain Controller, managing user accounts and security groups, and enforcing standard configurations across the domain using Group Policy Objects (GPOs). Fundamental security concepts covered include: 

• The basics of Kerberos authentication 

• Proper password policies 

• The role of Active Directory Certificate Services (AD CS) 

• An overview of necessary AD networking components, such as DNS and replication 

Campaign of the month: CVE-2025-9491  

In late 2025, a critical vulnerability tracked as CVE-2025-9491 (ZDI-CAN-25373) exposed a dangerous weakness in how Windows handles shortcut files. The flaw allows attackers to embed hidden command-line arguments within a .LNK’s Target field arguments that are not visible in the Windows Properties dialog due to a user interface truncation issue (CWE-451: UI Misrepresentation).  

This campaign demonstrates how even small interface flaws can yield outsized operational impact. The events surrounding CVE-2025-9491 underscore two enduring lessons:  

1. User interface trust can be weaponized 

2. Seemingly benign system features can conceal fully capable malware delivery mechanisms 

Access the full campaign here. 

New on the RangeForce platform

New course: AI for Security Operations 

Fresh out of the RangeForce oven, we proudly present an initial set of seven modules on Artificial Intelligence and Machine Learning. 

Theory Modules  

AI and Machine Learning Fundamentals 

Covering core concepts like the definitions of AI and ML, key terminology, and how AI enhances defensive capabilities in security operations, this module is the perfect 101 guide into the fundamentals of AI and ML. It also explores neural networks and deep learning. 

Generative AI and Large Language Models 

This module explains how Large Language Models (LLMs) work (next-token prediction, transformer architecture), their critical limitations, like hallucinations and the illusion of understanding, and their applications in cybersecurity on both the defensive and offensive fronts. 

Privacy, Ethics, and Security Risks of AI 

Examine the critical privacy, ethical, governance, and regulatory challenges surrounding AI systems. This theory module covers real-world data leakage incidents like the Samsung case and addresses AI bias and the ethical challenges outlined in the FATE framework (Fairness, Accountability, Transparency, and Ethics). It also reviews the EU AI Act and the risks. 

Interactive Modules 

AI-Assisted Reverse Engineering with Ghidra 

In this new hands-on lab, analysts use  PyGhidra-MCP, to connect an AI assistant directly to Ghidra’s reverse engineering capabilities. The goal is to analyze a Remote Access Trojan (RAT) plugin DLL using natural language queries instead of manual binary analysis. 

Introduction to Prompt Injection Attacks  

This module introduces learners to prompt injection attacks against Large Language Models (LLMs), covering the difference between direct and indirect prompt injection, and jailbreaking techniques. Learners practice hands-on exploitation through progressively challenging exercises to manipulate AI. 

Prompt Injection Exercise 

Here, learners test their skills against progressively challenging prompt injection attacks. This module is inspired by Lakera’s Gandalf game, where the goal is to extract a secret from an increasingly defensive AI guardian. It demonstrates how attackers exploit the helpfulness of LLMs to manipulate their output and bypass security controls. 

AI-Powered Threat Hunting with SIEM 

In this hands-on module, learners conduct an AI-powered threat hunting investigation using a Model Context Protocol (MCP) with a Splunk Security Information and Event Management (SIEM) platform. Learners use natural language queries to analyze logs, correlate events, and reconstruct a complete attack chain, such as working backward from a website defacement to identify the initial Log4Shell exploitation. 

These seven modules represent the first release in a full AI course that is currently being developed and is coming soon! 

New Interactive Module on the CompTIA Security+ course: Protecting Data with Backups 

Keeping true to our goal of providing Interactive modules to supplement theory learning, this interactive module (related to Exam Objective 3.4 under the Security Architecture domain) introduces essential backup concepts like Recovery Point Objective (RPO) and Recovery Time Objective (RTO).  

Learners are guided in designing a secure, compliant backup strategy and implementing encrypted snapshot-based backups using tools like restic and automated schedules using systemd. It also covers best practices such as snapshot consistency, recovery testing, and the importance of encryption for compliance with regulations like HIPAA and GDPR. 

Ready for what’s next? 

That’s a wrap for our first unified Cyberbit + RangeForce OUT NOW, and only the beginning of what’s coming. 

If you’re already a customer, it’s the perfect time to book your next Live-Fire Exercise and put your team to the test. 

If you’re new to Cyberbit and RangeForce, now’s the moment!  Request a demo and experience how our unified offering transforms cyber readiness. 

More breakthroughs, more modules, and more innovation are on the way. Stay tuned!