New Labs: BlackHat 2025 and DefCon 33
Throughout early August 2025, representatives from Immersive's cyber team attended the BlackHat 2025 and DefCon 33 conferences and got great exposure to the latest technologies, topics, and techniques presented by the sharpest minds in our industry. As a result of attending these talks, workshops, and villages, Immersive has created brand new labs going through the various talks that took place, allowing you to get hands-on with the latest technologies and exploits. We present a number of brand new labs covering some of the most interesting and insightful topics from the events, from operational technology (OT) to achieving privilege escalation through firewall software. AI was a hot topic, as you would imagine, especially around Prompt Injection attacks. We already have plenty of content on Prompt Injection, not to mention the new AI Foundations content, so for this series, we created an Appsec Style lab around preventing Prompt Injection attacks. Why should our customers care? BlackHat and DefCon are two conferences that attract the greatest minds in cyber to get together and share their knowledge through workshops, official talks, and villages. Given the high diversity of events and talks that took place, there is something for everyone! Many of the topic areas shared are things that attackers could easily exploit themselves, so taking advantage of the information in these labs equips our customers with the knowledge of the latest vulnerabilities, threats, and exploitation techniques currently being talked about in the industry - improving your resilience and preparation against the latest threats. Who are the labs for? Offensive Security Engineers and Penetration Testers SOC Analysts and Incident Responders Malware Reverse Engineers Operational Technology Engineers Cyber Security Engineers Here is a list of the labs in this release: Binary Facades: Extracting Embedded Scripts CVE-2024-5921 Redux - Bypassing mitigations to PrivEsc with Palo Alto Global Protect Chrome Alone: Transforming a Browser into a C2 Platform No VPN Needed?: Cryptographic Attacks Against the OPC UA Protocol Python: AI Prompt Injection If you'd like to do any of these labs, here is a link to the BlackHat/DefCon collection: https://immersivelabs.online/series/defcon-black-hat/New CTI Lab: CVE-2025-9074 (Docker Container Escape): Defensive
Pvotal Technologies published a write-up for a vulnerability in Docker Engine, given a CVSS score of 9.3. CVE-2025-9074 is a flaw in Docker Desktop that exposes the Docker Engine API to any container, with no authentication. Exploitation of this critical vulnerability allows a low-privileged container to issue privileged API commands, take over other containers, and, in some cases, mount the host drive and access files and folders and eventually achieve remote code execution. Why should our customers care? Many organizations rely on containerization in their development teams, and a vulnerability like this could allow an attacker to gain access to any to developer's workstation by mounting a developer's host drive. The possibility of supply chain attacks is increased due to malicious containers that can be used by developers, which can have start-up scripts that mount and "escape" the containerized environment. Who is the defensive lab for? System Administrators Developers SOC Analysts Incident Responders Threat Hunting Here are the links to the labs: Defensive: https://immersivelabs.online/labs/cve-2025-9074-docker-container-escape-defensiveImmersiveOne: Scattered Spider Release
Scattered Spider has continuously been a threat to many of our customers, and one of the reasons is that they have techniques and tactics that can affect all members of an organization. From their advanced social engineering tactics targeting less security-focused users in an organization to bypassing defences long enough to deploy ransomware and steal data from some of the largest organizations in the world. Therefore, Immersive is releasing an ImmersiveOne approach to protecting our customers. This means customers now have access to the following: Lab – Scattered Spider and Dragonforce: Campaign Analysis Lab – Threat Actors: Scattered Spider Workforce Scenario – Social Engineering Techniques Crisis Sim – Responding to a Scattered Spider Attack The technical and non-technical labs, workforce scenario, and Crisis Sim scenario release will enable everyone inside an organization to prepare and be ready for threats posed by Scattered Spider. For an in-depth blog on Scattered Spider and what to think about in a crisis, follow the link here: https://www.immersivelabs.com/resources/blog/scattered-spider-what-these-breaches-reveal-about-crisis-leadership-under-pressureArtificial Intelligence: Navigating the Evolving Landscape
The changing world To understand where we're going, you first need to grasp the sheer scale of what's happening now. The May 2025 report on Artificial Intelligence Trends by Mary Meeker and Bond Capital paints a vivid picture of a sector in overdrive: Unprecedented user adoption: Generative AI tools have achieved mass adoption faster than any previous technology, including the internet and smartphones. Soaring infrastructure investment: Top tech giants (Apple, NVIDIA, Microsoft, Alphabet, Amazon, Meta) spent a combined $212 billion on capital expenditures in 2024, a huge portion of which was dedicated to AI infrastructure like data centres and custom silicon. Shifting cost dynamics: The cost to train a state-of-the-art foundation model remains astronomically high, somewhere in the hundreds of millions of dollars. However, the cost to use these models (the inference cost) is plummeting, making AI more accessible than ever before. Intense competition and rapid imitation: AI is boosting productivity and driving competition between products. Global AI "space race": Nations are treating AI supremacy as a strategic imperative, leading to significant government investment and policy-making, particularly in areas like the semiconductor supply chain, with the US, Europe, and China all building new fabrication plants. With this level of investment and adoption, can you confidently say this is a bubble about to burst? Sir Demis Hassabis, CEO of Google DeepMind, puts this huge change on the same magnitude as the industrial revolution and the launch of the internet. Data from Gartner supports this, suggesting that by the end of 2025, 39% of organizations worldwide will have moved into the experimentation phase of AI adoption. The shift is well and truly on. What does AI look like in 2025? AI is underpinned by machine learning models, which are trained, not programmed. Engineers feed them vast amounts of data, and they learn patterns, concepts, and relationships. Different types of models are used for different purposes, such as those specialising in human language interactions (large language models, LLMs) and artwork generation (diffusion models). When using AI systems, such as chatbots, you’re not interacting with the model directly but rather with additional software that uses the model as its “brain”. This allows you to implement guardrails to check user inputs and model outputs, helping to filter out harmful or inappropriate content. Modern AI systems are rarely just a wrapper around a model. They integrate with other tools and services to enhance their capabilities, such as searching the web for real-time information or accessing private company documents to provide context-specific answers. The year of agentic AI An AI agent is a system that can autonomously pursue a goal. Instead of responding to a single prompt, it can reason, plan, and execute a series of steps to accomplish a complex task. It can also decide which tools to use and in what order. An AI agent may still be a chatbot or run constantly in the background. Big tech companies are adamant that agentic AI is the next evolution, with Google, Amazon, and Microsoft all predicting the next wave of innovation over the next two years. A key catalyst for this explosion was the release of the open-source Model Context Protocol (MCP) by Anthropic in late 2024. MCP provides a standardized way for AI models to discover and use tools. As the official documentation puts it: "Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect your devices to various peripherals... MCP provides a standardized way to connect AI models to different data sources and tools." Source: Model Context Protocol - Getting Started MCP has been a game-changer, dramatically simplifying the process of giving AI systems new capabilities and accelerating the move from AI systems that know things to AI systems that do things. It’s no coincidence that technology companies then started to release their guides for building AI agents following MCP’s release – with Microsoft, Google, Cloudflare, OpenAI, and Amazon following close behind. Technology to watch Finally, a few key technologies that will define the next phase of AI include: Model Context Protocol (MCP) Continue to watch this standard. As more tools and platforms adopt MCP, the ecosystem of "plug-and-play" capabilities for agents will explode, as will the security risks. Simon Willison puts it perfectly by describing a “lethal trifecta”. AI systems with access to private data, the ability to communicate externally, and exposure to untrusted content could easily lead to serious consequences. Source: Simon Willison Authorisation for AI systems As agents move from knowing things to doing things (e.g., booking travel, purchasing supplies, modifying code), security becomes paramount. We need robust authorisation. This will involve human-in-the-loop (HITL) approvals, likely powered by modern authentication standards like Client-Initiated Backchannel Authentication (CIBA), which can send a push notification to a manager to approve an agent's action. Thought leaders from Microsoft suggest an overhaul to OAuth, with agentic systems having their own distinct identities and security considerations. One thing’s for sure: proper authorization is complex – difficult to get right and catastrophic to get wrong. Agent-to-agent communication Current AI agents are specialized for a specific purpose, but next-generation AI functionality comes through the use of multi-agent systems, which can be deployed in a variety of architectures, such as hierarchical or swarms. How agents communicate with each other, share memory, and share capabilities is still in its relative infancy, especially when AI agents may be hosted independently and written with different frameworks. Two competing protocols are emerging: Google's Agent2Agent protocol and IBM’s Agent Communication Protocol (ACP). It's too early to call a winner, but the development of a standard here will be a major milestone. We are at the beginning of the agentic era. 2025 is the year for experimentation. It's time to move from simply using AI to actively building with it, automating the tedious, and unlocking new forms of creativity and productivity. Getting the most out of AI If one thing’s for sure, it’s that the AI landscape is moving fast. So it’s crucial that you and your organisation are at the forefront of AI developments and making the most out of the latest technologies. Keep your eyes peeled for brand new labs in this space coming very soon! Our brand new collection will demystify terminology, explore the core concepts, and let you build and secure modern AI systems in a safe, sandbox environment. Sign up for email notifications from the Immersive Community so you don’t miss out on this brand new collection.New CTI Labs: CVE-2025-53770 (ToolShell SharePoint RCE): Offensive and Defensive
Recently, a critical zero-day vulnerability affecting on-premise SharePoint servers, identified as CVE-2025-53770, was uncovered. This vulnerability allows for authentication bypass, leading to remote code execution, and has been actively exploited in the wild. Eye Security researchers detected an in-the-wild exploit chain on July 18, 2025, during an incident response engagement. This discovery led to Microsoft assigning two CVEs: CVE-2025-53770 and CVE-2025-53771. The attack notably leveraged a combination of vulnerabilities to achieve its objectives, impacting numerous SharePoint servers globally. There is now a public exploit available for anyone wanting to achieve remote code execution. Why should our customers care? This critical vulnerability has been added to the CISA Kev Catalog. and with no authentication or user interaction, a vulnerable SharePoint server can be fully taken over remotely, letting attackers run arbitrary code as if they were privileged admins. SharePoint is a complex and large system that often holds a lot of sensitive data for organizations and is often a targeted system for attackers. Who is the defensive lab for? System Administrators SOC Analysts Incident Responders Threat Hunters Who is the offensive lab for? Red teamers Penetration Testers Threat Hunters Here are the links to the labs: Offensive: https://immersivelabs.online/v2/labs/cve-2025-53770-toolshell-sharepoint-rce-offensive Defensive: https://immersivelabs.online/v2/labs/cve-2025-53770-toolshell-sharepoint-rce-defensiveNew CTI Lab: CVE-2025-32463 (Sudo Chroot Elevation of Privilege): Offensive
On June 30, 2025, the Stratascale Cyber Research Unit (CRU) team identified a critical local privilege escalation vulnerability in sudo, tracked as CVE-2025-32463. This vulnerability, related to sudo's chroot option, can allow an attacker to escalate privileges to root on an affected system. Why should our customers care? This critical vulnerability is reasonably trivial to exploit, and should an attacker gain user-level access to a vulnerable machine, they'll be able to elevate their privileges and have full control over the machine. It has come to our attention that not many people are aware that sudo has versioning. It is a binary that is constantly iterated upon, which naturally may introduce new vulnerabilities. If administrators and security analysts are not aware of how these vulnerabilities work, this can lead to significant risks and impacts. Who is it for? Red Teamers Penetration Testers System Administrators Here is a link to the lab: https://iml.immersivelabs.online/labs/cve-2025-32463-sudo-chroot-elevation-of-privilege-offensiveNew CTI/OT Lab: Norwegian Dam Compromise: Campaign Analysis
We have received reports of a cyber incident that occurred at the Lake Risevatnet Dam, near Svelgen, Norway, in April 2025. A threat actor gained unauthorized access to a web-accessible Human-Machine Interface (HMI) and fully opened a water valve at the facility. This resulted in an excess discharge of 497 liters per second above the mandated minimum water flow. Which persisted for four hours before detection. This attack highlights a dangerous reality: critical OT systems are increasingly exposed to the internet, making them accessible to threat actors. In this case, control over a dam’s valve system was obtained via an insecure web interface, a scenario that could have had even more severe consequences. A recent report by Censys identified over 400 exposed web-based interfaces across U.S. water utilities alone. This dam incident in Norway exemplifies the tangible risks posed by such exposures. In this lab, you will be taken through the attack from an offensive viewpoint, including cracking an HMI and fully opening two valves. Why should our customers care? OT environments, including dams, energy grids, and oil pipelines, are foundational to national security and daily life. These systems cannot be secured using traditional IT playbooks. As OT becomes more connected, tailored security strategies are critical to prevent unauthorized access and catastrophic failures. Who is it for? Incident responders SOC analyst Threat Hunters Red Teamer Penetration Testers OT Engineers Here is the link to the lab: https://immersivelabs.online/v2/labs/norwegian-dam-compromise-campaign-analysisNew CTI Lab: CVE-2025-33073 (SMB Elevation of Privilege): Defensive
Another vulnerability patched was released during Microsoft's June 2025 patch Tuesday review! An important elevation of privilege vulnerability was listed, and if exploited successfully, attackers can achieve elevation of privilege on the compromised machine. Even though it's not recorded to have been exploited in the wild as yet, the fact that research exists with details on how the vulnerability was found improves the chances an attacker will attempt to exploit this flaw against a victim.In these labs, you will be taken through the vulnerability from both an offensive and defensive perspective. Why should our customers care? This is a new vulnerability that has just been patched, and is has in depth research released about it. Successful exploitation of this vulnerability allows attackers to elevate their privileges and achieve command execution on a victim machine. Learn what sort of indicators this exploit leaves, but also learn how to execute and take advantage of this vulnerability! Who is it for? Incident responders SOC analyst Threat Hunters Red Teamer Penetration Testers Here is the link to the labs: Defensive: https://immersivelabs.com/v2/labs/cve-2025-33073-smb-elevation-of-privilege-defensive Offensive: https://immersivelabs.com/v2/labs/cve-2025-33073-smb-elevation-of-privilege-offensive Container 7 Release We have released a threat detection for this particular vulnerability, helping the community to protect against any potential use of this vulnerability. https://github.com/Immersive-Labs-Sec/SigmaRules/blob/main/cve-2025-33073-smb-exploit.ymlNew CTI Lab: Stealth Falcon (CVE-2025-33053) – WebDAV Server Remote Code Execution
Yesterday, in Microsoft's Patch Tuesday, there was a zero-day vulnerability that was patched and has been exploited in the wild! This zero-day was used by the cyber-espionage group Stealth Falcon and was reported on by Checkpoint. After successful phishing attempts, the user will execute a .url file that exploits a vulnerability to communicate with a WebDAV server owned by attackers, which holds a particular binary. The vulnerability is present because Windows will look for binaries through the WebDAV link before searching for the legitimate one on its own PC. Therefore, the attackers can achieve remote code execution. We are releasing a lab on hunting for the execution of this vulnerability to help teams create effective threat detections. Why should our customers care? This is a new vulnerability that has just been patched and has already been successfully used as part of threat groups' attack chains. Therefore, it is recommended to see what sort of indicators of compromise this type of vulnerability leaves once exploited. Who is it for? Incident responders SOC analyst CTI Analysts Threat Hunters Here is the link to the lab: https://immersivelabs.online/labs/stealth-falcon-cve-2025-33053-webdav-server-exploitation As part of the Container 7 team, we have also released threat detections that cover both binaries that were used in the campaigns that exploited CVE-2025-33053. You can find these here: https://github.com/Immersive-Labs-Sec/SigmaRules/blob/main/cve-2025-33053-iediagcmd-exploit.yml https://github.com/Immersive-Labs-Sec/SigmaRules/blob/main/cve-2025-33053-CustomShellHost-exploit.ymlNew CTI Labs: BadSuccessor: Offensive and Defensive
Two days ago, Akamai released a technical research blog post detailing a privilege escalation vulnerability in Windows Server 2025. This vulnerability abuses delegated Managed Service Accounts (dMSAs), and with the right base permissions, it could allow a user to gain domain admin permissions or even dump the NTLM hashes for all users in the domain. There is no patch available, and this would be considered a public zero-day. Why are these labs important? Many organisations use a Windows Domain to manage their users and accounts. This newly announced zero-day has no patch and no known detections in SIEMs. A combination of these labs will allow organisations to identify any potentially weak configurations vulnerable to exploitation and how to threat hunt in a SIEM to identify signs of exploitation. Who is it for? Incident responders SOC analyst CTI Analysts Threat Hunters Pentesters / Red Teams Here is the link to the analysis lab: BadSuccessor – Offensive BadSuccessor – Defensive
