New CTI Lab: Lazarus Cyberespionage Campaign: Analysis
In early November 2025, North Korean state-sponsored actor Lazarus was reported to have launched various attacks as part of a long-standing cyberespionage campaign linked to Operation DreamJob. Targets of the attacks include European organizations manufacturing unmanned aerial vehicles (UAV), aircraft component manufacturers, and British industrial automation organization. Lazarus's and by extension North Korea's operational objectives with these attacks is assessed with high confidence to be cyber espionage. What is this about? The attacks launched by Lazarus used a custom remote access trojan called ScoringMathTea RAT, which uses its own cipher system to obfuscate its code to conceal its functionality from analysts. The lab involves reverse engineering the malware and identify indicators of compromise by breaking the cipher and using that to identify what the malware is doing. Why is this critical for you and your team? North Korean cybercriminals and state sponsored actors are highly skilled, persistent, and aggressive in the pursuit of the North Korean regimes objectives, and one of those objectives is stealing information from targets that can affect national security. Understanding how North Korean cyber operators conduct attacks and understanding their tooling is essential for analysts to be better equipped to tackle these threats. Who is the content for? Malware Analysts and Reverse Engineers SOC Analysts Incident Responders Threat Hunters Tactical and Operational Cyber Threat Intelligence Analysts Here is a link to the lab: Lazarus Cyberespionage Campaign: AnalysisNew CTI Labs: CVE-2017-1000353 Offensive and Defensive (October 2025 CISA KEV Additions)
In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added five new vulnerabilities to its known exploited vulnerabilities catalogue, one of which was a critical 2017 vulnerability affecting Jenkins versions 2.56 and earlier and 2.46 LTS and earlier. This vulnerability allowed attackers to gain remote code execution on vulnerable instances. Why is this critical for you and your team? Jenkins is a widely used application. Shodan reports confirm that there are 000s of instances exposed to the internet, with the vulnerable versions. With this vulnerability being a critical remote code execution vulnerability, the impact is significant. Understanding how to investigate logs for this attack and understanding how to successfully achieve exploitation is important for any team. Even though it's a 2017 vulnerability, it's a very recent addition to CISA KEV, which illustrates just how significant it is, and that even today, attackers are using this vulnerability to gain footholds and compromise vulnerable victims. Who is the lab for? SOC Analysts Incident Responders Penetration Testers Red Teamers Threat Hunters Here are the links to the labs: Offensive: https://immersivelabs.online/v2/labs/cve-2017-1000353-jenkins-command-injection-offensive Defensive: https://immersivelabs.online/v2/labs/cve-2017-1000353-jenkins-command-injection-defensiveNew Labs - Malterminal: Malware Analysis
With artificial intelligence (AI) and large language models (LLMs) fast becoming a more popular and talked-about set of technologies in every industry in society, it's no surprise that LLM-enabled malware now exists that can dynamically generate code, query data, and offload malicious functionality to LLMs, lowering the barrier of entry for threat actors deploying malware. This lab introduces one of the first known malware samples to ever facilitate the use of LLMs to perform malicious functionality. Why should our customers care? Most, if not all, companies are looking into using AI to varying degrees, whether to make their workforce more efficient and productive or to build full models that facilitate technical processes. With this in mind, and with the advent of basic malware that can use API keys to query LLMs and AI services, we will likely see this particular malware set evolve over time. By doing this lab, you'll begin to see how these pieces of malware are just the stub and querier for AI and how they can be used maliciously. This will showcase what this threat is like in its current state. We shall be monitoring how this threat evolves, so stay tuned for more labs. Who is the defensive lab for? SOC Analysts Incident Responders Threat Hunting Here is a link to the lab: https://immersivelabs.online/v2/labs/malterminal-analysisCVE-2025-53770: Critical Zero-Day RCE Vulnerability in Microsoft SharePoint Servers
An unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2025-53770, has been discovered in on-premise Microsoft SharePoint Servers. This critical zero-day flaw allows attackers to execute arbitrary code on a server without needing to authenticate, posing a significant security risk. The vulnerability has been actively exploited in the wild, with researchers detecting an exploit chain as early as July 18, 2025. What is CVE-2025-53770? The vulnerability stems from insufficient validation of user-supplied data, which can be exploited by a specially crafted request to the server. This allows a remote attacker to execute code with the permissions of the SharePoint application pool, leading to a full compromise of the server – meaning they could have access to sensitive data, install malware, and even have complete control over the system. Which systems are affected? This vulnerability impacts multiple versions of on-premise Microsoft SharePoint servers: SharePoint Server Subscription Edition (Versions earlier than KB5002768) SharePoint Server 2019 (Versions earlier than 16.0.10417.20027/KB5002754) SharePoint Server 2016 (Specific version numbers vary, but generally earlier than the latest security updates) SharePoint Server 2013 and 2010 (While these are end-of-life and no longer supported, Microsoft still lists them as being potentially affected) How could attackers use this vulnerability? Bad actors are actively exploiting CVE-2025-53770 to gain initial access to corporate networks. Since the vulnerability is unauthenticated, attackers can scan the internet for vulnerable SharePoint servers and execute their exploit without needing any user credentials. Once exploited, they can deploy web shells to maintain persistent access, install ransomware, exfiltrate sensitive company data, or use the compromised server as a pivot point to move laterally within the network and attack other systems. The fact that it’s easy to exploit and the high level of access it grants make this a particularly dangerous vulnerability for any organization with an on-premise SharePoint deployment. How to protect your organization To protect your organization from this critical vulnerability, you need to take immediate action: Apply security patches Microsoft has released security updates to address this vulnerability. It’s crucial to apply these patches to all affected SharePoint servers immediately. Hunt for indicators of compromise (IoCs) Since this vulnerability was a zero-day and exploited in the wild, it’s essential to check for signs of a breach. Security teams should analyze SharePoint and web server logs for suspicious requests, particularly those involving unexpected file uploads or unusual processes being executed by the SharePoint application pool identity. Look for newly created .aspx or .ashx files in SharePoint directories that aren’t part of a standard installation. Implement network segmentation Restrict access to your SharePoint servers from the internet as much as possible. If external access is necessary, consider placing the server behind a web application firewall (WAF) with rules designed to block common web attack patterns. Enhance monitoring Increase monitoring of SharePoint servers for any anomalous behavior, such as unexpected outbound network connections, high CPU usage from SharePoint-related processes, or suspicious scheduled tasks being created. Conclusion In conclusion, CVE-2025-53770 represents a severe and immediate threat to organizations utilizing on-premise Microsoft SharePoint Servers. As a critical, unauthenticated remote code execution vulnerability being actively exploited in the wild, it provides a direct gateway for attackers to achieve a full compromise of server integrity, leading to potential data breaches, ransomware deployment, and significant operational disruption. Your response to this threat must be swift and comprehensive. Immediately applying Microsoft’s security patches is a critical first step to prevent exploitation. However, due to its nature as a zero-day exploit, organizations must also assume possible compromise and proactively hunt for IoCs. Strengthening network segmentation and enhancing monitoring are vital secondary measures to protect against this and future threats. Ultimately, a decisive and layered security response is essential to mitigate the substantial risks posed by this vulnerability. Recommended content To learn how to detect and exploit this vulnerability in a sandboxed environment, check out the following labs on the Immersive platform: Defensive: CVE-2025-53770 (ToolShell SharePoint RCE) Offensive: CVE-2025-53770 (ToolShell SharePoint RCE) Share your thoughts Have you seen this vulnerability being exploited in the wild? Have you patched your systems yet? Share your thoughts by commenting in the thread below.
Labs Live
This event has now ended. You can watch the recording here. Ever felt totally stuck with a lab? Getting frustrated? Maybe you could have used the helpful guidance of an expert? Introducing Labs Live, a groundbreaking community webinar series from Immersive! For the first time, we're bringing you live, interactive lab sessions led by seasoned professionals. In each Labs Live webinar, you'll collaborate directly with an expert as they navigate a challenging lab. They'll share their techniques, answer your questions, and together, you might even discover new insights. This isn't just a demonstration; it's a hands-on learning experience.Don't miss out on this unique opportunity to elevate your cyber skills. Our very first Labs Live session will be hosted by KevBreen Senior Director of Cyber Threat Research, as he tackles the latest Cyber Threat Intelligence Lab. Join him on April 25th to solve it together!New CTI Lab: CVE-2025-9074 (Docker Container Escape): Defensive
Pvotal Technologies published a write-up for a vulnerability in Docker Engine, given a CVSS score of 9.3. CVE-2025-9074 is a flaw in Docker Desktop that exposes the Docker Engine API to any container, with no authentication. Exploitation of this critical vulnerability allows a low-privileged container to issue privileged API commands, take over other containers, and, in some cases, mount the host drive and access files and folders and eventually achieve remote code execution. Why should our customers care? Many organizations rely on containerization in their development teams, and a vulnerability like this could allow an attacker to gain access to any to developer's workstation by mounting a developer's host drive. The possibility of supply chain attacks is increased due to malicious containers that can be used by developers, which can have start-up scripts that mount and "escape" the containerized environment. Who is the defensive lab for? System Administrators Developers SOC Analysts Incident Responders Threat Hunting Here are the links to the labs: Defensive: https://immersivelabs.online/labs/cve-2025-9074-docker-container-escape-defensiveConfessions of a Blue Teamer: How Unseen Work Pays off in a Crisis
In the fast-paced world of cybersecurity, the spotlight often shines on the dramatic breach or the sophisticated attack. But you know the truth: true resilience isn't about the heroics during a crisis, but the countless hours of unsung, diligent work that happens long before an incident ever escalates. This webinar offers an inside look at the often-overlooked, critical efforts of defensive cybersecurity professionals. Join seasoned Blue Teamers Kev Breen and Kevin Marriott from the Immersive Container 7 research team, plus Natalie George from BT Group, as they pull back the curtain on the quiet dedication and meticulous processes that underpin a truly robust defense based on real-world experiences. This session will highlight the daily real work that builds an unshakeable security posture. You’ll gain valuable insights into: The Unseen Foundations of Incident Response: Understand how the continuous, often repetitive, work of tuning, hardening, and practicing directly translates into a calm, effective, and decisive response when a real-world crisis unfolds. Transforming "Boring" into Bulletproof: Discover how the disciplined execution of seemingly mundane tasks – like log analysis, alert triage, and play runbooks – is the true differentiator between a team that panics and one that performs under pressure. Cultivating a Culture of Proactive Defense: Learn actionable strategies for embedding the "unseen work" mentality within your SOC, fostering a team that embraces continuous improvement, hones their skills through constant practice, and thrives on the quiet satisfaction of preventing crises before they start. This is your opportunity to hear hot takes on blue team efforts to build the bedrock of an organization's cyber resilience. Don't let your team be defined by what goes wrong; empower them with the foresight, training, and robust cyber readiness. Being truly ready isn't a stroke of luck. It's the direct result of the work no one sees.ImmersiveOne: Scattered Spider Release
Scattered Spider has continuously been a threat to many of our customers, and one of the reasons is that they have techniques and tactics that can affect all members of an organization. From their advanced social engineering tactics targeting less security-focused users in an organization to bypassing defences long enough to deploy ransomware and steal data from some of the largest organizations in the world. Therefore, Immersive is releasing an ImmersiveOne approach to protecting our customers. This means customers now have access to the following: Lab – Scattered Spider and Dragonforce: Campaign Analysis Lab – Threat Actors: Scattered Spider Workforce Scenario – Social Engineering Techniques Crisis Sim – Responding to a Scattered Spider Attack The technical and non-technical labs, workforce scenario, and Crisis Sim scenario release will enable everyone inside an organization to prepare and be ready for threats posed by Scattered Spider. For an in-depth blog on Scattered Spider and what to think about in a crisis, follow the link here: https://www.immersivelabs.com/resources/blog/scattered-spider-what-these-breaches-reveal-about-crisis-leadership-under-pressureOperational CTI: Creating a Proof of Concept
# Recorded on 30th July 2025 Creating proof of concepts (PoC) isn’t always straightforward — it requires a deep understanding of both the target system and the underlying vulnerability. In this session, we’ll walk through how Immersive's Cyber Threat Intelligence (CTI) team move from identifying a vulnerability to developing a working PoC used in offensive lab environments. Join us to explore the tools, thought process, and technical steps that turn raw intelligence into actionable outcomes for detection, validation, and defence.` This is a live session and there will be opportunities to ask questions to Immersive CTI experts.Operational CTI: How Immersive Builds Labs for Real-World Threat Preparedness
This event has now ended. You can watch the recording here. --- 📢 Today's the day! Our exclusive Community webinar 'Operational CTI: How Immersive Builds Labs for Real-World Threat Preparedness' will be live at 3pm GMT (10am EST). Here's a few tips to help you get the most from your experience: 🚀 This is a live, interactive session. Make sure you join the session promptly in order to get the full experience. 🔗 To join today's session, visit the event page or simply use the Zoom link. ❓You’ll also have the opportunity to participate in a Q&A with our expert panel so you can leave with an action plan to turn your ideas into reality! You can pre-submit questions here. Event Description Have you ever wondered how Immersive Labs can release CTI labs on the latest threats so quickly? Come backstage with us on this ✨ Community Exclusive ✨ event to learn just how we do it. BenMcCarthy and benhopkins, two of the experts from the CTI team will reveal what it takes to make a lab, some of their favourites from 2024 and what is to come from the CTI team. Agenda What are CTI labs and how do we select labs to build? Build Stage 1 - Research Build Stage 2 - "Labified" Build Stage 3 - Content Build Stage 4 - QA Some of our favourite labs Examples of speedy launches of labs C2 research What next for our Threat Research and CTI Labs You’ll also have the opportunity to pre-submit questions here so you can ensure that you leave with all of the information you need! This is a Community Exclusive event: Hit the attend button to register. This webinar will be live at 3pm GMT and will be recorded.
