February is the month of love. 

But while the world is busy celebrating roses and chocolate, we’re here to help you fall in love with something even more important: your team’s readiness! 

This month’s OUT NOW may be short, but it packs a punch. From privilege escalation and cloud credential theft to AI supply chain risks hiding inside pre-trained models, February’s release is all about protecting what matters most.  

Because nothing says “true love” like locking down your environment before attackers sweep it off its feet. 

Let’s dive in. 

New on the Cyberbit platform   

New Live-Fire Exercises 
Path to Privilege 

A domain user runs a trojanized “auto-clicker” that deploys a beacon, which performs host reconnaissance and reports to C2. The attacker escalates privileges via scheduled-task PATH hijacking. Using the elevated permissions, the attacker manages to steal AWS credentials, exfiltrate data, and perform lateral movement within the network.  

Campaign of the month: Malware of AI Models 

Pre-trained AI models are becoming a serious supply chain security risk. Attackers can hide malicious code inside model files or packages, causing malware to execute automatically when the model is loaded, even before inference begins.  

Because many public models still use insecure serialization formats like Python pickle, downloading untrusted models from repositories such as Hugging Face or PyPI can lead to remote code execution, credential theft, and ransomware.  

In this month’s campaign, learners will explore how these attacks work and how to defend against them using safer formats, scanning tools, sandboxing, and signing best practices. 

Access this campaign here.

New on the RangeForce platform 

New Interactive Modules 
AI for Security Operations Course: Model Context Protocol (MCP) Overview 

This module introduces participants to the Model Context Protocol (MCP) and gives them practical experience standing up an MCP-enabled workflow for cybersecurity operations. You configure MCP infrastructure by installing Splunk’s MCP Server app and setting up Codex as the MCP client, building the foundation for agentic AI-assisted analysis workflows used later in the course.  

Hands-on steps include installing the Splunk MCP Server app in Splunk Web, restarting services, and then establishing secure access using token-based authentication (JWT or bearer tokens). 

Coming Soon: RAG is under attack! 

Think your AI assistant is smart? Let’s see how it handles betrayal. 

In this upcoming AI-focused LFE, defenders step into a world where a Retrieval-Augmented Generation (RAG) system is quietly poisoned from within. A malicious PDF slips past weak indexing controls inside the “NetFabric” knowledge base, and suddenly, the AI starts treating attacker-controlled content as trusted truth. 

What begins as subtle misinformation escalates into a full-blown compromise, with the potential for reverse shell access straight to the attacker’s server. 

Can your team trace the poisoned retrieval path, expose the manipulation, and restore trust in the system before the AI becomes the insider threat? 

Stay tuned; this one’s going to be smart, sneaky, and seriously fun! 

Love your readiness 

If February is about commitment, let it be your commitment to cyber readiness. 

Start the year strong by putting your team through hands-on, realistic scenarios that sharpen instincts and build confidence where it counts. 

Book your next Live-Fire Exercise today and show your security program some real love!