Welcome back to the Cyberbit OUT NOW monthly release! 

This month, the one theme running through almost everything we’re shipping is, surprise, surprise, AI and how it has moved inside the SOC, working both sides of the fight.  

AI now drafts your queries, summarizes your alerts, and explains the logs you don’t recognize. It also shows up as the thing under attack, as a confidently wrong colleague, and as a whole new category of risk that someone now has to own. 

September’s release meets that reality head-on.  

Let’s jump into the new content. 

New LFEs 

Pandora (AI Supply Chain Compromise) 

Releasing later this week

In Greek mythology, opening Pandora’s box unleashed consequences that could not be contained. At Commensurate Technology, the box is a routine software update. An engineer pulls the newest version of a widely used AI gateway, the same dependency that sits in roughly a third of cloud environments, and simply running it is enough. Behind the ordinary version bump is a poisoned build: attackers compromised the software supply chain upstream, planted a backdoor in the package, and shipped it through the update channel every team already trusts. 

Once the lid is off, everything escapes at once. The update quietly disables monitoring, harvests cloud credentials, and reaches an over-permissioned automation account that hands the attacker control of the environment. There is no phishing email to catch and no perimeter alarm to chase; the breach arrives inside a signed, trusted dependency, an incident with no front door. Modeled on the real TeamPCP supply chain campaign, this new DRI5 Live-Fire Exercise drops participants into a compromise that spans developer tooling, the AI supply chain, and the cloud. The lid is already open. The exercise is everything that comes next: scoping the blast radius, tracing the backdoor to its source, and shutting it down before more gets loose.

Reworked LFEs 

Proserpina (Ymir Rusty Stealer & Ymir Ransom Rave) 

It all starts with an audio-driver update. A user downloads and runs what looks like a routine AudioDriver.msi, and a Meterpreter session opens back to the attacker. From that foothold the attacker escalates to SYSTEM, dumps credentials from memory, and stages a multi-stage PowerShell toolkit that profiles the host, exploits the mRemoteNG connection manager to recover saved plaintext logins, and sweeps the local subnet for its next targets. 

Those recovered credentials carry the attack across the network over PowerShell Remoting, planting SYSTEM-level scheduled tasks on each workstation to launch the ransomware. On every compromised host the payload encrypts user files, appends a new extension, drops a ransom note, and rewrites the logon banner, while staged data is posted back to the attacker’s server. Participants trace the intrusion from the trojanized installer and its C2 channel through credential theft, task-chained PowerShell, and lateral movement, then work the containment and forensic analysis that the ransomware and its persistence leave behind.

Fortuna (Selective Ransomware)

A spearphishing email dressed up as an HR message lands in an employee’s inbox, carrying a macro-enabled spreadsheet named for a salary update. Opening it runs the macro, pulls a PowerShell payload from the attacker’s server, and establishes a reverse shell. The attacker sets a scheduled task for persistence, then runs reconnaissance to map live hosts and launches a password-spray attack against the Linux systems it finds. 

With a stolen Linux admin credential, the attacker moves over SSH to the database server, deploys ransomware that encrypts files and appends its own extension, and exfiltrates sensitive data in compressed archives before encryption, holding the key back for extortion. Participants follow the chain from the phishing attachment and macro execution through persistence, password spraying, and SSH lateral movement, then investigate the exfiltration and ransomware deployment on a Linux target where the impact is deliberately selective. 

Campaign of the month: AI Hallucinations in the SOC 

Every other campaign we run puts an attacker in front of your team. This one puts your own tools there. AI assistants are now part of the working day in the SOC, drafting detection queries, summarizing alerts, and explaining unfamiliar log entries. The catch is that they produce fluent, confident output whether that output is right or wrong, because a language model generates the most plausible next words, not verified facts. A fabricated CVE, an invented log field, a query that runs cleanly and silently matches nothing, an alert closed as benign when it was not: each one reads exactly like a correct answer. 

This month’s campaign explains why hallucination is a built-in property of how these models work rather than a rare bug, why a model’s stated confidence tells you nothing about its accuracy, and how attackers turn overreliance into an attack surface through techniques like slopsquatting and prompt injection. Your team will understand why AI output should always be treated as a lead, never as evidence. 

Access the full campaign here >>   

New modules 

AI for Security Operations Course 

Hands-on Lab: Building Detection Rules with AI  

Participants investigate a Log4Shell exploitation on a public web server, separate a failed JNDI lookup from one that executed, draft a detection from those findings, tune it down to the genuinely exploited hosts, and deploy it as a live Splunk alert. 

Hands-on Lab: AI-Powered SOC Triage 

Participants work a queue of triggered Splunk alerts in severity order, cross-reference each against the night shift’s handover notes, close the ones explained by a ticket or change window, and connect the single external address that ties three alerts into one incident. 

Hands-on Lab: AI-Assisted Phishing and Email Analysis 

Participants triage reported messages by reading the headers against SPF, DKIM, and DMARC results, pulling the real link targets out of the HTML, and checking artifacts against VirusTotal, learning why an empty reputation result is not a clean bill of health. 

AI-Assisted Cloud IR Challenge: AWS Logs 

A challenge lab that opens on EC2 instance-role credentials calling the AWS API from an external address, asking participants to reconstruct the full cloud attack chain from CloudTrail back to an SSRF request against the metadata endpoint, then follow the persistence and data theft that come next. 

AI-Assisted Cloud IR Challenge: Azure Logs 

The identity-driven companion challenge, where a password spray leads to an Entra ID takeover and participants follow the trail through a registered authentication method, a Global Administrator grant, and a backdoor application registration up to subscription scope. 

AI Governance, Risk, and Compliance Course 

Theory Module: Why AI Needs Its Own Governance, Risk, and Compliance Approach 

A theory module that separates established GRC, AI security, and AI governance, examines what makes an AI system harder to govern (non-determinism, model drift, opaque decisions, and inherited training-data risk), and lands on the four decisions that need a named owner. 

Theory Module: AI Governance Structures and Roles 

A theory module on how organizations actually organize AI governance across centralized, federated, and embedded models, the roles governance depends on from the build side to the oversight side, and the decision rights and separation of duties that keep accountability clear. 

AI is in the room now 

AI is no longer a topic the SOC “will get to eventually”. It is already doing a big chunk of the work and is waiting for someone to decide who governs it. September’s release meets AI on every one of those fronts, from a supply chain LFE with no front door, to a campaign that teaches your team to distrust a confident answer, to hands-on AI operations and the governance that has to wrap around them.  

Readiness in an AI-shaped SOC is the same readiness it always was: verify before you act, and exercise until the response is second nature. 

Ready to see how your team performs? Schedule your next Live-Fire Exercise on the Cyberbit Readiness platform, or book a demo to watch your team in action against the attacks defining this moment.