CISA AA26-237A red team assessment results

Related Happenings

Timeline

1. 26.08.2026 16:07 1 articles · 4h ago

   Organization A is fully compromised through default credentials and AD CS abuse

   Victim Impact Update

   Organization A, a Government Services and Facilities Sector target, is fully compromised at the domain level after a web application with default credentials for built-in accounts lets the red team send phishing emails from an internal address and land on four workstations. Privilege escalation follows through a default Machine Account Quota and a misconfigured Active Directory Certificate Services template, then cleartext credentials, decrypted database configuration files, and static Amazon Web Services (AWS) access keys open three sensitive business systems and cloud resources. In the cloud, a Primary Refresh Token is stolen and Entra ID applications with elevated permissions are abused to read the security team's email and check whether defenders are aware of the activity, while the organization does not detect the activity and a real SCCM alert is dismissed as a false positive amid thousands of noisy alerts and no shared SOC visibility.

   Show sources

   • CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing — thehackernews.com — 26.08.2026 16:07

   Open in new tab
2. 26.08.2026 16:07 1 articles · 4h ago

   Organization B detects phishing payloads and isolates workstations within minutes

   Detection Ioc Update

   Organization B, a Water and Wastewater Systems Sector target, detects the initial phishing payloads as each one executes and isolates the affected workstations within 2 to 20 minutes, cutting off command-and-control before the intrusion can spread. After the foothold is severed, trusted agents at the organization execute a red team payload on a designated non-privileged host to support an assume-breach model, and the team still reaches the same underlying weaknesses, including an SCCM configuration file with cleartext credentials for a domain service account that has rights over a domain controller and is used for DCSync to retrieve the krbtgt secret. The engagement also reaches a bastion host in the operational technology demilitarized zone, but outbound internet access is blocked and no C2 channel is established, so the OT systems themselves are not entered.

   Show sources

   • CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing — thehackernews.com — 26.08.2026 16:07

   Open in new tab
3. 26.08.2026 16:07 2 articles · 4h ago

   CISA releases AA26-237A on simultaneous red team assessments

   Initial Disclosure

   CISA releases AA26-237A, "A Tale of Two SOCs," describing simultaneous red team assessments against a Government Services and Facilities Sector organization and a Water and Wastewater Systems Sector entity, with both targets fully compromised at the domain level. The advisory contrasts a complete lack of detection at Organization A with rapid detection and containment at Organization B and frames the outcome gap as a people-and-process problem rather than a tooling problem.

   Show sources

   • CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing — thehackernews.com — 26.08.2026 16:07
   • CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing — thehackernews.com — 26.08.2026 16:07

   Open in new tab