Welcome back to the Cyberbit OUT NOW monthly release!  

Trust, legitimacy, and familiar workflows take center stage this month. Attackers keep finding ways to hide inside trusted files, accepted tools, and everyday activity, turning what looks normal into the start of a full compromise. 

For defenders, readiness means learning how to question that trust, investigate subtle signals, and connect small anomalies before they have a major impact. 

Let’s jump into the brand-new content. 

New LFE 

Daphne (RAG Poisoning)

AI systems are built on trust in the data they retrieve. Daphne challenges that trust. 

In this new Live-Fire Exercise, participants begin with what looks like a routine knowledge base workflow, only to uncover subtle inconsistencies in how information is retrieved and presented. Answers don’t quite add up, patterns begin to shift, and the investigation leads deeper into the system’s ingestion process, where something has clearly gone wrong. 

As the exercise unfolds, participants piece together how a seemingly legitimate document altered the behavior of the entire system. What starts as misleading output quickly escalates into a broader compromise, forcing teams to trace the source, understand the impact, and regain control before trust in the system collapses completely. 

Reworked LFEs 

Cupid (Trojan Share Privilege Escalation) 

A spear-phishing lure disguised as a shipping notification kicks off a multi-stage compromise that escalates far beyond the initial click. 

The attacker establishes a Meterpreter session, poisons a legitimate scheduled task on the file server, silently creates a rogue domain admin account, tunnels to the database server, creates a rogue MySQL account, and exfiltrates sensitive data through two separate paths. 

Participants trace the phishing email, investigate the initial compromise, uncover scheduled task abuse and share poisoning, detect rogue account creation across Active Directory and MySQL, and analyze the dual-vector exfiltration path. 

Aeneas (Killer Trojan) 

A trojanized Office 2019 installer ISO turns a familiar software deployment scenario into a full enterprise investigation. 

After execution, the attacker escalates to SYSTEM, dumps LSASS credentials, abuses a service account password recovered from LSA Secrets, accesses the file server over SMB, steals and compresses classified documents, and exfiltrates them through the internal Exchange relay. The attack then expands into a mass internal phishing campaign and WMI-created scheduled task persistence. 

Participants investigate the trojanized ISO, follow the C2 channel, trace credential dumping and service account abuse, identify SMB lateral movement, and uncover persistence and email-based exfiltration. 

Pegasus (Golden Ticket) 

A macro-enabled Excel attachment opens the door to one of the most damaging privilege escalation paths in enterprise environments. 

The attack begins with phishing and a multi-stage PowerShell implant communicating over an FTP-based C2 channel on port 443. From there, the attacker Kerberoasts a SQL service account, cracks the ticket offline, moves laterally to the Domain Controller through WinRM, disables Windows Defender, performs DCSync, and forges a Golden Ticket for persistent unrestricted access. 

Participants follow the attack from the phishing email and macro execution to Kerberoasting, lateral movement, DCSync, and Golden Ticket abuse in a scenario built around deep domain compromise. 

Janus (Fileless Techniques) 

A simple typo is all it takes to start the attack in Janus. 

Participants begin with what looks like a routine user mistake, a visit to a misspelled domain that quietly delivers a malicious file. From there, the trail quickly shifts from endpoint activity to something more elusive. This LFE is all about subtle signs of execution, persistence, and control that don’t behave the way they should. 

As the investigation deepens, participants uncover how the attacker operates without leaving traditional traces, maintaining access through hidden mechanisms and expanding their reach beyond the initial machine. What starts as a single compromised user evolves into a broader threat, forcing teams to trace the attack across systems, understand how it spreads, and stop it before it turns into something much larger. 

Campaign of the month: Introduction to APT29 (aka Midnight Blizzard) 

APT29, also known as Midnight Blizzard, is one of the most persistent and adaptive state-sponsored threat actors operating today. Attributed to Russia’s Foreign Intelligence Service (SVR), the group has been behind major operations such as the SolarWinds supply chain attack and continues to evolve its tactics toward stealthier, trust-based techniques. 

Recent campaigns highlight this shift, including the use of malicious .RDP files, legitimate tools, and malware-light tradecraft to bypass traditional defenses. This month’s campaign pairs directly with the new APT29 lab, giving teams the context to understand how the group operates and the opportunity to apply that knowledge in a hands-on investigation. 

Access the full campaign here >> 

New Hands-on Labs 

Agentic Orchestration for SecOps Course: Incident Investigation and Case Creation with AI

Participants step into the role of a SOC analyst working entirely inside Codex, an AI agent connected through MCP to Splunk, MISP, and TheHive. The lab begins with a web defacement alert and quickly expands into a full investigation workflow. 

From triaging alerts in Splunk to pivoting into threat intelligence in MISP and building a structured case in TheHive, participants follow the attack from first signal to final resolution. The focus is on how modern analysts connect tools, context, and decision-making into a single investigation flow. 

Attacker TTPs Course: APT29 Detection and Indicators of Compromise

This lab takes a defender-focused approach to one of today’s most adaptive threat actors. Participants hunt the APT29 Rogue RDP attack chain in Splunk, starting from initial access and moving through multiple stages of attacker activity. 

As the investigation unfolds, they uncover credential dumping, Pass-the-Hash lateral movement, WMI-based execution, persistence, and data exfiltration. The lab brings together these behaviors to show how APT29’s living-off-the-land techniques remain detectable through careful analysis of system activity. 

ICS Security Essentials Course: Technical Security Concepts for Operational Technology

This lab serves as the final module in the ICS Security Essentials course, focusing on the technical foundations of securing OT environments. Participants explore key defense-in-depth concepts that are critical for protecting industrial systems. 

The lab covers six core pillars, including network containment, access control, endpoint hardening, protocol-aware monitoring, segmentation, and backup and recovery. Each concept is grounded in real-world scenarios and mapped to industry frameworks, helping participants connect theory to practical defense 

the successful authentication, and uncover how the attacker staged, deployed, and verified the defacement. 

More LFE-inspired Challenges 

Web Shutdown IR 

An attacker port-scans and brute-forces SSH access to a public web server, then installs a cron job that repeatedly stops the nginx service. 

Participants investigate the outage in Splunk, tracing the activity from initial scan to brute force access and persistence. 

Web Defacement IR 

An attacker uses port scanning and SSH brute force to compromise a public-facing web server, then replaces the website with a defacement archive deployed through sudo. 

Participants identify the scanning activity, trace the successful authentication, and uncover how the attacker staged, deployed, and verified the defacement. 

Lateral Movement IR 

A malicious payload delivered on a USB drive establishes a Meterpreter foothold and opens the way to registry credential dumping, pivoting to an MSSQL server, compromise of the Domain Controller, and data exfiltration back to the USB drive. 

Participants trace the full chain in Splunk from the first callback alert to pass-the-hash movement, domain compromise, and exfiltration. 

Red MITM 

This red team challenge puts participants on the attacker’s side of a man-in-the-middle operation. 

Using ARP poisoning and DNS spoofing, they intercept and redirect internal traffic, deliver a Meterpreter payload through a rogue SMB share and phishing email, and use the resulting session to exfiltrate a confidential credentials file. 

Multi-stage intrusion SOC 

An attacker moves step by step through the environment, chaining together multiple techniques to reach a high-value target. 

What begins as external reconnaissance quickly escalates into an FTP compromise, internal pivoting, and MSSQL brute force, ending in the exfiltration of a full database backup. Participants investigate in Splunk, reconstructing the entire attack chain from a single alert and uncovering how each stage connects to the next.  

When trusted things stop being safe 

Spring is usually associated with a reset. In cybersecurity, that means taking a fresh look at the places where trust has become risk. 

This month’s release reflects that reality. 

April’s content focuses on attacks that blend into real environments and force defenders to investigate what others might overlook. Because readiness is not built by assuming trusted things are safe. It is built by practicing how to verify, investigate, and respond when they are not. 

Ready to put your team to the test? Book your next LFE and see how your team performs against modern attack paths designed to hide in plain sight!