Did you know May is the month the Romans named after Maia, Greek goddess of growth and renewal? 

Four of our reworked LFEs this month carry the names of Roman deities — Venus, Faunus, Vesper, and Bacchus — each delivering a very modern attack chain, from steganography-laced spear-phishing to SQL injection pivots into a database shell. 

We are also introducing the Dirty Frag campaign and two new Hands-on Labs on Linux privilege escalation, plus six new LFE-inspired Challenges built around incident response practice. 

May is about depth, realism, and the kind of attacks that reward teams who exercise often. Let’s dive in. 

Reworked LFEs 

Vesper (WMI Worm)

In the Vesper incident, a user is tricked into executing a malicious installer delivered via a CD, which deploys a worm that establishes persistence, evades defenses with a watchdog process, spreads laterally across the network, and launches a denial-of-service attack. 

Vesper is a reminder that physical media is still a vector, and that worms with watchdog logic are stubborn to remove. Participants exercise detection, scoping, and containment against an opponent that keeps trying to resurrect itself. 

Bacchus (Data Leakage via SQL Injection)

An opportunistic threat actor scans Commensurate Technology’s public marketing site with web vulnerability tooling and finds an unsanitized POST parameter in the contact form vulnerable to SQL injection. From there, the attacker pivots into PostgreSQL's COPY … TO PROGRAM functionality to gain OS command execution as the postgres user.  

They stage a Python3 bind shell on TCP/8080 with @reboot crontab persistence, dump pg_shadow hashes along with the application’s .pgpass and .env secrets to ekj8f.txt, and exfiltrate the credential dump inline through the SQL injection channel itself before deleting the staging script. 

Participants trace the reconnaissance, the SQLi-to-RCE primitive, the bind shell persistence, and the file-creation and deletion trail in Splunk and Sysmon. Disruption means blocking the attacker IP, isolating the web host, disabling the abused PostgreSQL role, killing the bind shell, removing the crontab and persistence payload, and stopping the vulnerable web application. A full-spectrum exercise that rewards methodical investigation. 

Venus (Corporate Espionage) 

A sophisticated spear-phishing campaign sets its sights on corporate source code. The attacker sends a malicious Word document that quietly executes a hidden macro, which in turn pulls a PNG image from an external server. What looks like a benign image is anything but. The macro uses PowerShell to decode a malicious payload hidden inside the image pixels via steganography. Once decoded and executed, the payload sweeps every available network share for source code files (.py, .cs, and more), then exfiltrates them. 

The malware spreads laterally from Patient Zero to three additional hosts using compromised Administrator credentials. Patient Zero exfiltrates data directly, while the infected hosts route their stolen files to a secondary external IP acting as a CNC server. Participants pick up the trail through a SIEM alert for suspicious network traffic and work backwards through the chain, from the macro execution and the steganographic decode, to the lateral spread and the dual exfiltration paths. 

Faunus (Email Dumper)

Faunus opens with a familiar lure: a malicious Excel file with an embedded VBA macro. From there, the chain escalates fast. The macro downloads and executes a PowerShell payload from an external IP, which establishes a Metasploit Meterpreter reverse shell on Patient Zero. The attacker creates a scheduled task for persistence, then uses PsExec to move laterally to a second workstation. 

From the second host, the attacker pivots again, this time using plink.exe (an SSH client) to remotely access a Linux mail server and create a tar archive of every email mailbox under /var/mail/*. The archive is exfiltrated back through the compromised Windows hosts to attacker infrastructure. Anti-forensic techniques are layered on top, including obfuscated PowerShell and the deletion of plink.exe to cover the tracks. Participants exercise the full Windows-to-Linux pivot, the persistence chain, and the cleanup attempt. 

Campaign of the month: Dirty Frag 

This month’s campaign drills straight into the Linux kernel. Dirty Frag is built around two recent CVEs that, on their own, would already be uncomfortable, and when chained, deliver universal Local Privilege Escalation on vulnerable Ubuntu 22.04 desktops. Both vulnerabilities live in obscure corners of the kernel (xfrm-ESP and RxRPC, with a separate AF_ALG / algif_aead path), and both turn into write primitives against the page cache that let an unprivileged user weaponize /usr/bin/su or rewrite /etc/passwd. 

The campaign walks participants through the exploitation chain, the realistic detection opportunities (file-integrity monitoring, audit, kernel-module load events, in-memory vs on-disk hash comparison), and the pragmatic stop-gap mitigations like module blacklisting under /etc/modprobe.d/. It is exactly the kind of campaign that prepares blue teams for the LPEs they will inevitably read about in the next CVE advisory. 

Access the full campaign here >>  

New Hands-on Labs 

CVE-2026-43284/43500 Dirty Frag: Universal Linux Local Privilege Escalation 

Participants chain two unrelated Linux kernel page-cache write primitives — xfrm-ESP (CVE-2026-43284) and RxRPC (CVE-2026-43500) — to corrupt /usr/bin/su or /etc/passwd from an unprivileged shell on a vulnerable Ubuntu 22.04 desktop, capturing a flag from /root/flag.txt. They then review file-integrity, audit, and kernel-module load detections, and apply the realistic stop-gap mitigation by blacklisting the esp4, esp6, and rxrpc modules under /etc/modprobe.d/. 

CVE-2026-31431 CopyFail: Linux Privilege Escalation 

Participants exploit a deterministic logic flaw in the Linux kernel’s AF_ALG / algif_aead code path, where splice()-fed page-cache pages land on the AEAD destination scatterlist and the authencesn ESN rearrangement turns into a 4-byte arbitrary write that weaponizes /usr/bin/su‘s in-memory image without ever touching the on-disk binary. After running the published PoC to land a root shell and capture the flag from /root/flag.txt, they work through the high-signal detections (AF_ALG socket audit, authencesn template hunting, in-memory vs on-disk SUID hash comparison) and the patch-the-kernel or blacklist-algif_aead remediation paths. 

LFE-inspired Challenges 

Ransomware IR 

A macro-enabled phishing email lands an “URGENT: Q4 Budget Review” .docm in a user’s mailbox; opening it spawns PowerShell with -ExecutionPolicy Bypass, which downloads fc8b16.ps1 from an external host, AES-encrypts the user’s Desktop with a .EZCRYPT extension, drops a README_DECRYPT.txt ransom note, and runs vssadmin to delete Volume Shadow Copies.  

Participants work the kill chain backwards in Splunk from a Defender Behavior:Win32/GenShadowCopy!rsm alert through Sysmon file and process events, PowerShell ScriptBlock logging, PAN-OS firewall traffic, and Exchange MessageTracking to land on the originating phishing email. 

Email Exfiltration IR 

A spoofed internal phishing email delivers a trojanized invoice ZIP that the user double-clicks; the binary creates a scheduled task (ExfilTask) that drives wscript.exe SendFile.vbs to automate Outlook over COM and send three back-to-back attachments (employee salary data and VPN credentials) to a mail.ru recipient.  

Participants triage a “Bulk Outbound Email to Blacklisted Domain” alert in Splunk and pivot across Postfix mailrelay, Exchange MessageTracking, and Sysmon process-creation events to identify the automated send, the schtasks-launched persistence, and the inbound phish that started the chain. 

Data Exfiltration IR 

A trojanized OfficeInstall.exe plants a hidden scheduled task (“Microsoft PowerShell Updater Task”) that runs updater.ps1 on a one-minute cadence, repeatedly screen-captures the desktop as PNG, and POSTs each frame to an attacker-controlled listener.  

Participants triage a “Hidden Scheduled PowerShell Detected” alert in Splunk, read the script through PowerShell ScriptBlock Logging (EventCode 4104), confirm exfiltration in Sysmon NetworkConnect events and PAN-OS traffic, then walk the schtasks creation back to the user-clicked dropper and capture its SHA256 IOC. 

DMZ Breach IR 

An external attacker fingerprints a vulnerable Reflex Gallery WordPress plugin, uploads image.php as a web shell via the plugin’s unauthenticated upload endpoint, and pivots from the DMZ WordPress host into the internal MySQL server, brute-forcing the MySQL root account before a successful login enumerates the bookshop database, and exfiltrates the payments table.  

Participants triage a “Multiple Failed MySQL Logins from DMZ” alert and reconstruct the breach end-to-end in Splunk across MySQL query logs, sysmon:linux process events, pan:traffic flows, and the WordPress nginx access log. 

Behavioral Ransomware Detection 

A victim visits an infected internal Reactivities webapp page that triggers an LNK-launched PowerShell dropper; PowerShell fetches fc8b16.ps1 from an external host, AES-256-encrypts the user’s Desktop with a .locked extension, drops a README_DECRYPT.txt ransom note, and runs vssadmin delete shadows to wipe recovery points.  

Participants triage a Defender behavioral Ransomware detection in Splunk and reconstruct the chain across Sysmon process/file/network events, PowerShell ScriptBlock Logging, and the webapp nginx access log back to the page that delivered the dropper. 

Keylogger IR 

A Nikto-driven attacker stuffs 37 stored XSS payloads into the description field of the internal Reactivities webapp’s /api/Activities endpoint, planting a CSS-only password keylogger that exfiltrates each keystroke via background:url() fetches to port 3001, bypassing Sysmon network logging because the beacons originate from Chrome.  

Participants triage a “Stored XSS Injection Detected” alert and walk the chain forward in Splunk through the Reactivities API log, PAN-OS firewall flows, and Sysmon process-create to confirm the browser as the carrier and identify the victim user. 

Renewal in the SOC: From myth to muscle memory 

If May is the month of growth, the SOC version of growth is muscle memory. The gods of the LFE catalog are not just thematic; they reflect what readiness actually looks like in 2026. 

Attackers who hide payloads in image pixels, who pivot from a web form into a database shell, who chain unrelated kernel bugs into universal root, who automate Outlook to walk credentials out the front door. The teams that handle these incidents calmly are the teams that have seen them before, in exercise after exercise. 

That is what this release is for.  

Ready to put your team in the hot seat? Book your next LFE today or book a demo to see your team in action.