March brings spring and a clear theme to the Cyberbit content catalog. 

Cloud exposure, modern attack paths, and intelligence at scale take center stage this month. Attackers continue to move fast across interconnected environments, turning small gaps into full compromises. 

For defenders, readiness means staying sharp, adapting quickly, and practicing how everything connects under pressure. 

Let’s jump in! 

New LFE 

Azure MediLeak 

Cloud-native applications introduce new attack paths, and Azure MediLeak brings them to life in a full attack chain. 

In this Azure-based scenario, attackers compromise a medical appointment scheduling web app and escalate quickly. They achieve remote code execution, discover an internal API server, and exploit a malicious update mechanism to deepen their foothold. 

The attack does not stop there. It extends into database discovery, data exfiltration, and persistence through a backdoor on the update server. 

Participants experience how a seemingly isolated web vulnerability turns into a full cloud compromise, and how attackers pivot between services when visibility is limited. 

Reworked LFEs: More flexibility, same realism 

Two of the most popular LFEs, Supply Chain Attack and Dragonfly, have been remastered with an array of new tool combinations.  

Defensive teams can now choose to configure either exercise with SIEMs from Splunk, Sentinel and Elastic and EDR solutions from Defender, CrowdStrike, and SentinelOne. Firewalls are provided by Palo Alto Networks.  

As the reworked exercises are available in both Alert Triage (SIEM and EDR) and Threat-Hunting (SIEM only) formats, participants have further control of how they use the new tools. 

Vulcan (Supply Chain Attack) 

A malicious executable disguised as a Windows update enters the environment and establishes a DNS-based command-and-control channel. The attacker performs account discovery, achieves persistence through the Print Spooler service, and exfiltrates Outlook mailbox data. 

Participants trace the full supply chain compromise, from initial execution to data exfiltration, while identifying persistence and communication mechanisms along the way. 

Callisto (Dragonfly) 

A targeted spear-phishing attack compromises a developer and leads to a full domain takeover. The attacker establishes a Meterpreter session, dumps domain credentials, and moves laterally across servers using PsExec. 

Persistence, data collection, and anti-forensics techniques follow, ending with full database exfiltration. 

Participants investigate each stage, from phishing to privilege escalation and lateral movement, in a scenario that reflects real-world attack progression. 

New Interactive Module (Hands-on Lab) 

AI for Security Operations Course: AI-powered threat intelligence with MISP 

Threat intelligence becomes more powerful when it connects signals across events. This new interactive module brings that concept into practice using AI and MISP. 

Participants work through a full intelligence workflow using Codex connected to a MISP MCP server. The journey starts with exploration, then pivots from a real EDR observable tied to Log4Shell into deeper investigation. 

From there, the lab connects seemingly isolated indicators across multiple Emotet campaigns, demonstrating how patterns emerge at scale. It concludes with a realistic triage scenario, where participants validate indicators, assess relevance, and create new intelligence based on active sightings. 

This is intelligence work as it happens in real SOC environments. Context, correlation, and decision-making under time pressure. 

New Challenges 

This month, we also introduce two new LFE-inspired Challenges (also known as Quests), designed to sharpen investigation skills through targeted scenarios. 

Coin Miner 

A multi-stage intrusion spreads coin-mining malware across the network. Participants investigate the attack in Splunk, tracing it from initial payload delivery through lateral movement and WMI persistence. 

SQLi to Domain Compromise 

A chain of misconfigurations enables an attacker to escalate from SQL injection to domain-level impact. Participants uncover how small weaknesses combine into critical business disruption. 

Campaign of the month: Azure Functions Vulnerable to Information Disclosure (CVE-2026-21532) 

Serverless environments often hide complexity behind simplicity. This month’s Campaign of the Month focuses on what happens when that abstraction breaks. 

CVE-2026-21532 highlights a high-severity information disclosure vulnerability in Azure Functions. Attackers exploit it remotely to access sensitive configuration data, connection strings, and internal metadata. 

Because serverless functions connect across cloud services, this exposure becomes a launch point for lateral movement. 

In this campaign, participants investigate how attackers leverage leaked data to pivot deeper into cloud environments. They also learn how to detect and mitigate these risks through stronger secret management, reduced exposure, and effective Azure monitoring. 

Access this campaign here >>

Turning cloud complexity into readiness 

Spring is about renewal. In cybersecurity, that means reassessing exposure, refining processes, and strengthening how teams respond when it matters most. 

This month’s release focuses on that reality. 

From Azure exploitation paths to intelligence correlation and full attack chains, the content reflects how modern attacks unfold across systems, identities, and data. 

Because readiness is not built through isolated skills. It is built by practicing how people, processes, and technology come together under pressure 

Ready to put your team to the test? Book your next Live-Fire Exercise and see how your team performs against real-world cloud threats.