Welcome back, defenders! 2026 has officially booted up. 

We’re kicking off the new year with fresh Live-Fire Exercises, cloud-focused SOC Quests, and hands-on labs that dive straight into the threats shaping today’s environments.  

Let’s start 2026 the right way. 

New on the Cyberbit platform  

New Live-Fire Exercises  

YMIR Ransom Rave Part II with Defender 

Jump back in the Ymir Rusty Stealer exercise with this direct sequel. Using previously stolen credentials, the adversary pivots from the compromised user daniel.higgins to launch a coordinated multi-host attack that culminates in Ymir ransomware deployment.  

Participants investigate MS Defender alerts to trace user-executed malware, PowerShell staging, scheduled tasks, WinRM lateral movement, registry changes for pre-logon messaging, and widespread file encryption with ransom note artifacts. 

Azure Backup Abuse 

This adventure is everything your team needs to test their reflexes!  

An attacker gains initial access to an endpoint through a trojanized auto clicker utility acting as a dropper for a RAT.  

Once executed, the RAT performs host enumeration and discovers a misconfigured, elevated backup service.  

The attacker exploits this vulnerability and achieves local privilege escalation to full administrative access. With elevated permissions, the attacker retrieves a SAS token used by the backup service to interact with an Azure Blob container. Leveraging the stolen token, the attacker exfiltrates sensitive corporate data stored in the blob, compromising backups from all corporate endpoints. 

New AWS SOC Quest items 

Fleeting Keys 

In this Quest, SOC analysts examine how subtle misconfigurations and overlooked indicators can converge into high-impact security events, prioritize high-signal alerts and correlate them into a coherent incident timeline.  

Analyze activity across multiple layers of the cloud environment to identify abnormal patterns that indicate potential compromise. Building these linkages reveals the full event flow from exposure to misuse, enabling timely containment and effective remediation. 

Vanishing Trust 

In this Quest, you will assess how early anomalies within application and network interactions can reveal emerging threats, enhancing your ability to identify, correlate, and escalate potentially malicious activity with precision. 

SOC teams must rapidly interpret signals from diverse telemetry sources and determine which behaviors warrant deeper investigation. Effective defense requires correlating subtle patterns across web traffic, infrastructure activity, and cloud services to isolate indicators of compromise. 

Lateral Drift 

Proper configuration of AWS Virtual Private Cloud (VPC) is crucial for strengthening security posture and protecting sensitive data. Misconfigurations can lead to potential risks and consequences, including unauthorized access, data breaches, and widespread network compromise. 

In this Quest, you will identify and mitigate common misconfiguration issues in an AWS service that can pose critical security concerns for organizations relying on cloud storage.   

The Unlocked Vault 

Proper configuration of S3 Buckets is crucial for strengthening security posture and protecting sensitive data. Misconfigurations can lead to potential risks and consequences, including unauthorized access, data breaches, and widespread network compromise. 

Admins need to understand various attack scenarios and best practices for configuring and securing S3 buckets to be better prepared to identify and address security vulnerabilities in their organization’s cloud storage solutions. 

In this Quest, the participants will learn to identify and mitigate common misconfiguration issues in S3 buckets that can pose critical security concerns for organizations relying on cloud storage. 

Campaign of the month: React2shell 

The CVE-2025-55182 vulnerability in React Server Components exposes a critical security weakness arising from insecure deserialization in the RSC “Flight” protocol. This vulnerability enables attackers to achieve unauthenticated remote code execution on a target server simply by sending a specially crafted HTTP request. The flaw effectively turned a core rendering mechanism of modern React and Next.js applications into a silent execution path for attacker-controlled code. 

Recognizing the severity of this vulnerability is essential for defenders.  

Although hardened releases of React and Next.js were made available shortly after disclosure, the campaign demonstrated how quickly attackers can weaponize deserialization flaws in widely deployed frameworks.  

Access this campaign for free here. 

New on the RangeForce platform 

New Interactive Modules 

CVE-2025-55182: React Server Components RCE (React2Shell) 

This month’s campaign teaches you all about the recent React2Shell vulnerability, and this interactive module takes participants to the next level.  

You’ll gain hands-on experience by first fingerprinting a live HR application for Next.js-specific headers before utilizing a Python-based exploit script to achieve pre-authentication remote code execution.  

The interactive lab requires participants to methodically execute a multi-stage attack: 

1. Abusing insecure deserialization to hijack server-side logic 

2. Injecting malicious JavaScript to execute system-level commands 

3. Exfiltrating sensitive employee salary data from the /var/hr/ directory through Base64-encoded HTTP response headers 

This deep dive demonstrates exactly how nation-state actors like Earth Lamia and Jackpot Panda bypass traditional security controls to compromise modern web environments and move laterally into sensitive filesystems. 

This hands-on lab will be available for free throughout February on the RangeForce platform.  

Access this Interactive Module here.  

Detection Engineering Fundamentals Course: Creating Basic YARA Rules 

This is an introduction to the foundational building blocks of YARA, explaining how metadata, strings, and conditions are used to hunt for malware. You’ll practice a real-world workflow, analyzing a technical write-up of the AsyncRat trojan, identifying unique .NET variable names, and crafting a rule that balances detection efficacy with the risk of false positives. The module reinforces the trade-offs in condition complexity and the importance of testing rules against safe samples before production deployment. 

CompTIA Security+ Content: Introduction to Asset Lifecycle Management 

Designed for foundational security roles, this module teaches the systematic process of tracking and controlling hardware, software, and data resources from procurement to disposal. Using the Snipe-IT platform, learners practice entering new assets, assigning ownership to establish accountability, and updating lifecycle statuses to prevent Shadow IT. The lab concludes with secure decommissioning, highlighting the importance of data sanitization (NIST SP 800-88) and Certificates of Destruction for regulatory compliance. 

New Theory Modules 

Introduction to APT41: Double Dragon 

This module provides a strategic profile of APT41, a unique Chinese threat actor that blends state-sponsored espionage with financially motivated cybercrime. You’ll trace the group’s evolution from targeting the gaming industry for profit to conducting massive supply-chain attacks like Operation ShadowHammer.  

The module maps APT41’s TTPs to the MITRE ATT&CK framework, focusing on their modular ShadowPad backdoor and their ability to hide malicious traffic within legitimate cloud services. 

Time to sharpen your instincts after the holidays and set the tone for the year ahead 

A new year is the perfect time to reset priorities and readiness should be at the top of the list. 

January’s OUT NOW is designed to get teams back in the action fast with realistic scenarios, high-signal investigations, and the kind of challenges that build confidence before attackers get their first move. 

Book your next Live-Fire Exercise now and give your team the hands-on experience they need to stay sharp, confident, and ready for whatever 2026 throws their way.