Loading story…
CISA’s parallel red-team assessments of an unnamed government organization and a water-sector organization found that both were initially compromised through phishing and Active Directory weaknesses, including default Machine Account Quota settings and misconfigured Active Directory Certificate Services templates. The simulated attackers escalated privileges and moved laterally; at the government organization, they reached sensitive business systems and cloud resources without effective detection, read SOC personnel email, and deployed keyloggers on defender workstations.
The water-sector organization detected and isolated compromised endpoints within 2 to 20 minutes, disrupted command-and-control traffic, and continued identifying malicious activity after CISA adopted an assume-breach posture. CISA attributed the divergent outcomes primarily to SOC operational maturity—alert triage, escalation authority, and cross-team communication—rather than security tooling. Both assessments identified cloud and identity-control gaps, including absent Conditional Access for workload identities and weak procedures for revoking compromised access and refreshing tokens; CISA urged operators to remediate AD weaknesses and strengthen identity controls and incident-response processes.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
CISA first published an advisory on its red-team activity.
CISA publicly released an advisory and report describing the two voluntary red-team engagements, contrasting the government organization's ineffective response with the water-sector organization's rapid containment. The agency urged organizations to remediate Active Directory and certificate-template weaknesses, strengthen credential and cloud-identity controls, and improve SOC escalation, coordination, and analyst authority.
With trusted access simulating an undetected compromise, CISA exploited the Machine Account Quota weakness, harvested SCCM credentials, conducted DCSync activity, and moved toward business, cloud, and OT DMZ systems. Defenders isolated a compromised OT-DMZ bastion host and blocked a suspicious Azure sign-in, demonstrating continued layered detection.
In a parallel assessment of a Water and Wastewater Systems Sector organization, three users clicked spearphishing links, but the SOC quarantined affected workstations within 2, 10, and 20 minutes and cut off command-and-control communications. CISA then shifted the exercise to an assume-breach model after the initial intrusion was detected.
During a red-team assessment of a Government Services and Facilities Sector organization, CISA gained access through phishing, escalated domain privileges through Active Directory weaknesses, and reached sensitive business systems and cloud resources without detection. The team also read SOC personnel emails and deployed keyloggers on defenders' machines; CISA attributed the ineffective response to alert overload, organizational silos, and inadequate escalation processes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcethehackernews.com
Open sourcecyberscoop.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA officials warned that a military confrontation with a peer adversary such as **Russia or China** would likely bring successful cyberattacks against U.S. critical infrastructure, causing severe disruptions across **water, power, healthcare, law enforcement, and parts of banking**. Agency leaders said operators should expect to lose reliable internet access, third-party and vendor connections, and some **SCADA** functionality, and should plan to continue delivering essential services in a degraded state rather than relying solely on traditional cyber hygiene measures. To support that shift, CISA is prioritizing operational resilience through its **CI Fortify** initiative, redirecting OT resources to conduct **75 to 100 assessments** over the next year and expand emergency planning guidance across sectors. Officials called for "ruthless prioritization" during crises, including decisions on which facilities receive limited water or power, while the EPA is preparing a national cybersecurity exercise for the water sector to test operations without supervisory control and data acquisition technology; CISA also warned that prolonged cyber-induced outages could erode public trust more sharply than natural disaster recovery delays.
Jun 29, 2026
Securelist reported that real-world compromise assessments repeatedly uncovered active and historical intrusions that had bypassed layered defenses, often because basic security controls failed in practice. Investigators linked successful breaches to delayed patching of internet-facing systems, employee and third-party policy violations, missed detections by MSSPs and SOCs, incomplete incident response, and misconfigured or ineffective tooling that left attackers operating undisturbed. In one case, attackers exploited a late-patched public web server, deployed a **SILENTTRINITY** C2 stager, used a custom-packed **Mimikatz** variant and **LSASS** memory dumping to steal credentials, then performed **SMB** reconnaissance until gaining domain administrator access. Other assessments found credential exposure through a third-party consultant, repeated webshell activity that an MSSP failed to escalate despite antivirus alerts, and malicious **Active Directory Group Policy** changes that enabled reversible password storage and weakened **Kerberos** auditing, underscoring compromise assessment as a last-resort method for finding hidden attacker persistence and validating whether defenses are actually working.
Jul 12, 2026
CISA reported multiple intrusions into organizations’ cloud environments in which attackers exploited weak security configurations, particularly in remote-work settings that mixed corporate and personal devices. The activity included phishing for cloud credentials, brute-force login attempts, abuse of valid accounts, and manipulation of email services after compromise. In several cases, attackers created or modified email forwarding rules to redirect sensitive messages to attacker-controlled accounts, sent phishing emails from internal compromised mailboxes, and concealed security warnings by moving them into RSS-related folders. The incidents also showed that **multi-factor authentication was not always sufficient on its own**: some brute-force attempts were blocked by MFA, but at least one account was still accessed, likely through stolen web session cookies in a **pass-the-cookie** scenario that bypassed MFA checks. U.S. government guidance urged organizations to harden authentication and cloud access controls by enforcing universal MFA, using conditional access policies, reviewing logs for anomalous sign-ins, restricting external email forwarding, blocking legacy authentication, securing exposed remote access services, and improving user awareness to reduce credential theft and session hijacking risks.
Aug 15, 2026