Introduction 

Welcome back to the Cyberbit OUT NOW monthly release! 

This month is about trust, and who gets to earn it. Attackers keep turning the things we rely on without a second thought into the opening move of a compromise. The open source packages our applications are built from, the colleagues we assume are who they say they are, and the familiar admin tools already sitting on the network are all manipulated and used as tools of compromise.  

At the same time, the analyst gets a new partner in the investigation. Two of this month’s labs put AI directly in the driver’s seat, using Codex through MCP to work a live intrusion across the SIEM and the packet capture. The same question runs through every item. 

What deserves your trust, and how do you prove it? 

Reworked LFEs 

Juno (APT40 Investigation) 

Releasing later this month 

APT40 is a state-sponsored espionage group known for patient, targeted intrusions against government, maritime, and research organizations. In the Juno exercise, your team faces that playbook end-to-end.  

The group gains initial access through a spear-phishing email whose malicious document runs macros to deploy malware, opens a reverse shell to attacker-controlled command and control, and sets persistence through registry keys and scheduled tasks. From there, they pivot across the internal network with harvested domain credentials, compromise a web server, plant a web shell for durable access, and exfiltrate data back to their own infrastructure.  

Your team will come away able to detect and disrupt a full espionage chain, from the first macro to the final exfiltration, working together under realistic incident pressure. 

Campaign of the month: Introduction to the Supply Chain Attacks 

Every application you run stands on a tower of open source packages, most written by people you will never meet. Installing one of them runs someone else’s code with your privileges. That single fact is the entire attack surface behind software supply chain attacks, and 2026 has been the year it went mainstream. 

This month’s campaign maps the landscape from that premise. It walks you through the dependency trust model and the four core poisoning techniques: typosquatting, dependency confusion, maintainer compromise, and trojanized updates. Then we dive into the campaigns that defined the year: the North Korean hijack of the Axios npm package, the self-propagating Shai-Hulud and Mini Shai-Hulud worms that turned one stolen credential into ecosystem-scale spread, and the rise of the AI toolchain as both a weapon and one of the richest targets in the dependency graph. 

Access the full campaign here >>  

New Hands-on Labs 

AI for Security Operations Course 

AI-Assisted Endpoint Forensics with Velociraptor 

Triage starts in the SIEM with a masquerading executable launching from a user’s Downloads folder, then the attacker stops the Splunk Universal Forwarder and the host goes dark. From there, participants come away able to keep the investigation moving without centralized logging. Driving Codex through MCP servers for Splunk and Velociraptor, they pivot to endpoint forensics, recover the local evidence the SIEM never received, and run an estate-wide hunt that surfaces a second compromised workstation and the backdoor account behind it. 

AI-Assisted Network Forensics with Wireshark 

A single packet capture from an infected workstation holds the whole story, if you can read it. Working in plain language instead of Wireshark display filters, with Codex driving tshark over MCP, participants come away able to reconstruct the full infection chain, from its DNS lookups to the FTP channels where the data left. They recover the stolen files intact, including saved mail credentials, learn to recognize where TLS ends the trail, and let Codex assemble the incident into a clean timeline. 

AI-Assisted Memory Forensics with Volatility 

A mass file-modification alert fires, memory is captured at the console before the machine is powered down, and the disk image is still being acquired, so RAM is the only evidence. Driving Codex through an MCP server wrapping Volatility 3 in plain language, participants come away able to reconstruct what the machine was doing at capture: who was logged on, which program ran and terminated, and, from the Windows file cache, the ransomware’s own log naming the files encrypted, the extension appended, and the attacker’s contact IP. 

AI-Assisted Dynamic Malware Analysis 

An EDR alert fires on an executable in a user’s Downloads folder. Static triage flags its networking and crypto imports, but the strings naming the C2 server and persistence value are XOR-obfuscated, so static analysis stalls. Driving Codex through an MCP server wrapping x64dbg in plain language, participants come away able to turn suspicion into proof: recovering the XOR key from the unpacking routine, reading the decoded C2 hostname and URI from memory, and pinpointing the staging file and Run key that keep the malware alive. 

Introduction to Kali Linux Tools Course 

Introduction to Social-Engineering Toolkit 

The easiest way into an organization is often a person, not a port. Using the Social-Engineering Toolkit (SET) from Kali, participants run two full attacks: cloning a company login page to harvest submitted credentials, and sending a spoofed spear-phishing email to an executive through an internal open relay. Each attack is paired with the control that defeats it, so participants come away able to both stage the technique and shut it down with HSTS, FIDO2 keys, and a DMARC reject policy. 

Introduction to the Impacket Toolkit 

One foothold on a domain-joined host is enough to go after the entire directory. Using Impacket against a live Active Directory domain from Kali, participants chain the attack end to end: enumerate accounts, AS-REP roast and Kerberoast for crackable tickets, loot an SMB share, run a DCSync to dump every domain hash, and pass-the-hash into a shell. Just as valuable, they come away able to name the domain controller event IDs and behavioral indicators that expose each step, so the skill cuts both ways. 

Enumerating Active Directory with BloodHound 

Privilege in Active Directory rarely sits where the membership lists say it does; it accrues transitively through nested groups and permissions. From a low-privileged foothold, participants collect the domain with SharpHound over Evil-WinRM, work past the double-hop problem that breaks remote LDAP queries, and import the data into BloodHound Community Edition to model it as a graph. The outcome is the ability to surface the true members of Domain Admins, spot kerberoastable and no-preauth accounts, and use Pathfinding to trace, then cut, the shortest route to domain dominance. 

Introduction to Kali Linux Tools Challenge 

No guided path this time. Participants land on a Kali machine inside a target network with three hosts, no credentials, and four flags marking a full compromise. They chain the whole toolkit on their own judgment: finding an unlinked page, extracting a web app’s config, cracking its password hashes, and reusing a credential over SSH, then pivoting through password reuse to a domain-joined workstation and on to the domain controller, where one service account is misconfigured two ways at once. Choosing the right tool is the real test. 

Trust is earned in the investigation 

The through-line this month is trust, and how quickly attackers turn it against defenders. A single poisoned dependency reaches thousands of downstream projects. A convincing spoofed email walks credentials out the door. A stolen service ticket opens a path straight to the domain controller. Each item in this release exercises the same discipline: verify the thing everyone else assumes is safe! 

AI joins that discipline this month rather than replacing it. The AI-assisted forensics labs put Codex beside the analyst to accelerate triage across the SIEM and the wire, while showing exactly where the fundamentals still carry the investigation. 

Ready to put your team to the test? Book your next Live-Fire Exercise and see how they perform when the trusted path turns hostile.