Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted simultaneously against two critical infrastructure organizations, using what it described as similar tradecraft while recording sharply different defensive outcomes. Both organizations were fully compromised at the domain level, and in both, the red team also
Analysis Summary
# Incident Report: CISA Red Team Assessment (Advisory AA26-237A)
## Executive Summary
CISA conducted simultaneous red team assessments against two critical infrastructure organizations using similar tradecraft. While both organizations suffered full domain compromise, Organization B demonstrated resilient detection and response by isolating threats within minutes, whereas Organization A failed to detect the intrusion due to alert fatigue and fragmented security operations.
## Incident Details
- **Discovery Date:** August 25, 2026 (Advisory Publication)
- **Incident Date:** 2026 (Concurrent Assessments)
- **Affected Organization:** Referred to as Organization A and Organization B
- **Sector:** Organization A: Government Services & Facilities; Organization B: Water & Wastewater Systems
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** Simultaneous engagements in 2026.
- **Vector:** Phishing and Credential Abuse.
- **Details:**
- **Org A:** Exploited a web application with default credentials to send internal phishing emails.
- **Org B:** Executed phishing payloads (detected by SOC).
### Lateral Movement
- **Org A:** Abused default Machine Account Quotas and misconfigured Active Directory Certificate Services (AD CS) templates (ESC1/Certighost) to move across the domain.
- **Org B:** Following an "assume-breach" pivot, used cleartext credentials from an SCCM configuration file to gain rights over a domain controller.
### Data Exfiltration/Impact
- **Cloud Access:** Stole Primary Refresh Tokens and abused over-privileged Entra ID applications to read security team emails.
- **OT Access:** Reached a bastion host in Org B’s OT demilitarized zone (thwarted by lack of outbound internet).
- **Domain Level:** Full domain-level compromise achieved in both organizations.
### Detection & Response
- **Org A:** Failed to detect activity. Thousands of false positives obscured real alerts. An alert on an SCCM server was dismissed because analysts couldn't identify the system owner.
- **Org B:** SOC detected phishing payloads immediately and isolated workstations within **2 to 20 minutes**, successfully severing C2 communications.
## Attack Methodology
- **Initial Access:** Default credentials on web apps; Phishing.
- **Persistence:** Static AWS access keys (never-expiring); Primary Refresh Tokens.
- **Privilege Escalation:** AD CS Template abuse (ESC1); Machine Account Quota abuse.
- **Defense Evasion:** Leveraging high volumes of legitimate traffic/alerts to hide activity.
- **Credential Access:** Cleartext credentials in database config files and SCCM files; DCSync attack to retrieve `krbtgt` secret.
- **Discovery:** Reconnaissance of internal SCCM and AD structures.
- **Lateral Movement:** AD CS exploitation; Bastion host access.
- **Collection:** Accessing Sensitive Business Systems (SBSs) and reading administrative emails.
- **Exfiltration:** Cloud resource access via stolen tokens.
- **Impact:** Total domain compromise and access to sensitive business/cloud resources.
## Impact Assessment
- **Financial:** Not disclosed; potential for high recovery costs.
- **Data Breach:** Exposure of sensitive business systems, email communications, and cloud resources.
- **Operational:** Org B successfully maintained operations; Org A suffered total loss of environment control.
- **Reputational:** CISA use of these cases as a "Tale of Two SOCs" highlights systemic failures in Org A.
## Indicators of Compromise
- **Network indicators:** C2 communications from workstations to external IPs (Defanged: hxxp[://]external-c2[.]com).
- **File indicators:** Cleartext credentials in `web.config` and SCCM configuration files.
- **Behavioral indicators:** Abnormal use of `Certighost` / ESC1 certificate requests; unauthorized DCSync activity.
## Response Actions
- **Containment:** Org B isolated hosts within 20 minutes.
- **Eradication:** Revocation of misconfigured AD CS templates; resetting `krbtgt` passwords.
- **Recovery:** Revocation of static AWS keys and Entra ID application permissions.
## Lessons Learned
- **Visibility:** Fragmented security tools and multiple SOCs without shared visibility (Org A) lead to detection gaps.
- **Alert Fatigue:** High volumes of false positives cause analysts to dismiss genuine threats.
- **Authority:** SOC analysts require the authority to act and clear escalation procedures to be effective.
- **Process over Tools:** Both used similar tools, but Org B's superior processes for isolation prevented a full-scale breach.
## Recommendations
- **Active Directory:** Reduce Machine Account Quota to 0 and audit AD CS templates for ESC1 vulnerabilities.
- **Credential Hygiene:** Prohibit storage of cleartext credentials in configuration files and enforce rotation for cloud access keys.
- **SOC Optimization:** Implement alert tuning to reduce noise and ensure all critical assets have identified owners.
- **Network Segmentation:** Ensure OT bastion hosts lack direct outbound internet access to prevent C2 establishment.