CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.
CISA advisory AA26-237A documents two simultaneous red team assessments. Organization A (Government Services sector) missed the intrusion entirely, as default credentials on a web app, ADCS ESC1 abuse, and thousands of false-positive alerts let the red team reach sensitive business systems and read SOC email. Organization B (Water/Wastewater sector) detected, isolated, and reimaged hosts quickly, but both orgs lacked Conditional Access for workload identities, and B still exposed DCSync, Golden Ticket, and OT network attack paths.
- Org A: default-credential web app, ESC1 ADCS abuse, and alert fatigue led to unnoticed full domain compromise
- Org B detected and quarantined quickly but had plaintext SCCM credentials enabling DCSync and Golden Tickets
- Both orgs lacked Conditional Access for workload identities, letting the red team read mailboxes via Microsoft Graph
- CISA urges ADCS hardening, Machine Account Quota 0, removing cleartext credentials, and better alert tuning
- ATT&CK
- T1078 Valid AccountsT1534 Internal SpearphishingT1649 Steal or Forge Authentication CertificatesT1003.006 DCSyncT1558.001 Golden Ticket
- Vendors
- Microsoft
- Threat actors
- CISA Red Team
- Victims
- Organization AOrganization B
- Organizations
- CISA
- Countries
- United States
From the original article
4 min read at securityaffairs.com
CISA red teams fully compromised two critical infrastructure orgs. One SOC isolated hosts in minutes; the other never detected the breach. CISA published an advisory ( AA26-237A ) documenting two simultaneous red team assessments at critical infrastructure organizations.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.