As the year winds down and the logs finally quiet (we hope!), it’s time for one last push before we roll into 2026. 

This is our final OUT NOW release of the year, and we’re ending on a high note with new Live-Fire Exercises, forward-looking campaigns, and deep technical training across both the Cyberbit and RangeForce platforms.   

This month’s content is built to make sure you start 2026 ready, not reactive! 

Let’s take one last deep dive before the clock strikes midnight. 

New on the Cyberbit platform 

New Live-Fire Exercises 

Simple Exfil Service 

It starts quietly, with an attacker mapping the public surface of the Skytrek web application. Beneath the interface lies a backend powered by AWS SQS, quietly shuttling messages between services, a perfect place to hide in plain sight. 

The attacker discovers weak input validation in a Lambda-driven processing pipeline by probing the system. Carefully crafted messages are pushed into the queue, each one carrying a malicious payload. What looks like routine traffic is anything but. 

As the messages are processed, the payloads slip through, triggering SQL injection against the connected RDS database. One message at a time, sensitive data is extracted and exfiltrated, all without ever touching the database directly. 

In this Live-Fire Exercise, defenders must uncover how trusted cloud services were turned into the attack path, trace the flow from SQS to Lambda to RDS, and shut down a breach hiding in the heart of normal operations. 

Ymir Ransomware Rave with CrowdStrike — Part II 

Part I of the Ymir LFE with CrowdStrike and Microsoft Defender is already available on the platform, and now it’s time to get ready for Part II! 

As a direct sequel to Ymir Rusty Stealer, this exercise presents an attack using the Ymir ransomware, commonly known to follow Rusty Stealer in execution chains. The ransomware encrypts all files in the Azure environment and plants a ransom note as a legal notice in the Registry.  

Stay tuned as part II of this exercise will also be available for investigation with Defender in the near future. 

Campaign of the month: LLM and RAG Attacks 

To overcome the limitations of static training data and hallucinations, organizations have rapidly adopted Retrieval-Augmented Generation (RAG), a pattern where an LLM is combined with a retrieval layer over enterprise data (document stores, vector databases, knowledge graphs). RAG promises more accurate, contextual, and up-to-date answers without retraining the base model. 

However, this architectural shift has a non-trivial side effect: it massively expands the attack surface. 

In this campaign, we dive deep into prompt injections in RAG and we explore successful detection and mitigation strategies.  

Access the full campaign here. 

New on the RangeForce platform 

New Interactive Modules 

Detection Engineering Fundamentals course: Crafting Detection Rules 

This lab bridges threat intelligence and detection engineering by tasking learners with building real network-based detections. Starting from a malware case involving Koi Stealer, learners analyze PCAP data to identify meaningful C2 behaviors. 

They then translate observed patterns into custom detection rules designed to catch malicious traffic reliably, emphasizing durable logic over brittle signatures. 

System Hardening Fundamentals course: Linux OS Hardening Essentials 

In this module, learners apply a practical Linux hardening baseline aligned with CIS Benchmarks and DISA STIG guidance. They secure user accounts, harden SSH, enable memory protections like ASLR, and enforce a default-deny firewall posture using UFW. 

The focus is on hands-on implementation and validation. Your team won’t just configure controls, they will verify effectiveness and document changes to reinforce operational discipline and prevent security drift. 

PAN-OS Security Policy Fundamentals course: Firewall Access Policies — PAN-OS Zone & Application Traffic Blocking 

Time for your team to step into a realistic firewall engineering scenario using a Palo Alto NGFW managed through Panorama. They design and validate access policies that deny unwanted traffic based on zones, services, and application behavior. 

A key focus is moving beyond port-based rules to App-ID–driven controls, demonstrating how precise traffic identification supports strong segmentation without disrupting legitimate business flows. 

CompTIA Cloud+ content: Deploy Azure Web Apps with Azure CLI and GitHub 

Aligned to CompTIA Cloud+ (Deployment 2.4 – Use code to deploy and configure cloud resources), this module introduces a code-first approach to cloud application deployment. Learners provision and deploy an Azure Web App using Azure CLI and GitHub, replacing manual workflows with repeatable, automated processes. 

Along the way, they validate deployments, explore operational considerations like autoscaling and pipelines, and reinforce best practices for production-ready cloud environments. 

Miscellaneous: Salt Typhoon IoC Analysis 

In this investigation-focused lab, learners analyze real-world indicators linked to the Salt Typhoon campaign. They pivot across file artifacts, registry evidence, and network activity to reconstruct attacker behavior. 

Using enrichment tools like VirusTotal and Hybrid Analysis, learners extract behavioral insights and translate them into practical hunting and detection strategies. 

New Theory Modules 

AI for Security Operations course: AI Alignment and Agentic Misalignment 

Explore what AI alignment really means as systems become more autonomous. Learn how agentic misalignment can resemble insider threats, why safety training alone isn’t enough, and what controls organizations must apply when deploying autonomous agents. 

AI for Security Operations course: The Evolving Threat Landscape with AI 

Examine how AI is reshaping cyber risk on both sides of the battlefield. This module covers AI-enabled fraud, social engineering, malware development, and direct attacks on AI systems, mapped to frameworks like MITRE ATLAS and OWASP Top 10 for LLM Applications. 

Ready for what’s next? 

And that brings us to the end of the year. 

As you plan for 2026, one thing is clear: readiness isn’t built at the moment of impact. It’s built now, through hands-on practice, realistic scenarios, and training that reflects how attacks actually unfold. 

So don’t wait for the next alert to ring in the new year. 

Book your next exercise, invest in readiness, and let’s make 2026 so secure… even Santa can’t breach it! 

Happy New Year and see you on the cyber range!