Full Report
Agency red-teamers got initial access to both organizations they tested, but one quickly isolated and shut down the attempts from going further. The post Water sector passes, government sector fails attempts to spot and halt simulated CISA attack appeared first on CyberScoop.
Analysis Summary
# Incident Report: CISA Red Team Assessment of Government and Water Sectors
## Executive Summary
CISA conducted simulated cyberattacks against two unnamed organizations to evaluate their defensive postures. While red teamers achieved initial access in both cases via phishing, the Water Sector organization (Organization B) successfully detected and quarantined the threat within minutes, whereas the Government Sector organization (Organization A) failed to respond despite receiving numerous alerts. The assessment highlighted critical failures in alert management and cloud security configurations across both entities.
## Incident Details
- **Discovery Date:** August 2026 (Report Publication)
- **Incident Date:** Simulated assessment period prior to August 2026
- **Affected Organization:** Not disclosed (referred to as Organization A and Organization B)
- **Sector:** Government (Org A) and Water/Critical Infrastructure (Org B)
- **Geography:** United States
## Timeline of Events
### Initial Access
- **Date/Time:** Not specified (Simulated exercise)
- **Vector:** Phishing and Spearphishing
- **Details:** In Organization A, attackers used an internal email address to phish workstations. In Organization B, a spearphishing campaign successfully induced three users to click malicious links.
### Lateral Movement
- **Organization A:** Attackers moved from workstations to sensitive business systems and cloud resources undetected.
- **Organization B:** Following an "assume breach" model (after the first attempt was caught), attackers moved to sensitive business systems, cloud resources, and an Operational Technology (OT) DMZ bastion host.
### Data Exfiltration/Impact
- **Organization A:** Full domain compromise, access to personnel emails, and compromise of sensitive business systems.
- **Organization B:** Minimal impact due to rapid detection; however, during the "assume breach" phase, attackers reached the OT DMZ before being caught a second time.
### Detection & Response
- **Organization A:** Failed to detect. SOC received low/medium EDR alerts but ignored them due to "alert fatigue" caused by thousands of false positives.
- **Organization B:** Highly effective. SOC triaged alerts and quarantined compromised workstations in 2, 10, and 20 minutes respectively.
## Attack Methodology
- **Initial Access:** Phishing/Spearphishing links and internal email spoofing.
- **Persistence:** Use of compromised access/refresh tokens in cloud environments.
- **Privilege Escalation:** Domain admin privileges gained (Org A); host-level escalation (Org B).
- **Defense Evasion:** Exploiting "organizational silos" and high volumes of false-positive alerts to mask activity.
- **Credential Access:** The report notes a lack of workload identity protection and failure to revoke compromised tokens.
- **Discovery:** Probing for sensitive business systems and OT DMZ bastion hosts.
- **Lateral Movement:** Pivoting from IT workstations to cloud resources and OT boundaries.
- **Collection:** Accessing personnel emails and sensitive business data.
- **Exfiltration:** Not explicitly detailed, but CISA noted access to cloud resources.
- **Impact:** Potential for operational disruption in water systems and total data loss in the government sector.
## Impact Assessment
- **Financial:** Not disclosed (Simulated).
- **Data Breach:** High potential (Org A: Personnel emails and business systems fully exposed).
- **Operational:** Critical risk; attackers reached the OT DMZ of a water utility.
- **Reputational:** Significant for the government sector due to total failure of SOC protocols.
## Indicators of Compromise
- **Network indicators:** Traffic to known malicious domains [hxxp://simulated-phish[.]com].
- **File indicators:** Malicious payloads/links delivered via email.
- **Behavioral indicators:** Unusual lateral movement from standard workstations to OT DMZ bastion hosts; high-volume EDR alerts triggered by credential dumping or privilege escalation tools.
## Response Actions
- **Containment measures:** Organization B utilized automated and manual isolation of workstations.
- **Eradication steps:** Clearing of compromised sessions and refresh tokens.
- **Recovery actions:** Strengthening of EDR alert tuning to reduce false positives.
## Lessons Learned
- **Alert Fatigue is Fatal:** Organization A’s failure resulted from thousands of false positives that "obscured" real attack signals.
- **Cloud Governance Gaps:** Both organizations underestimated cloud risks, particularly regarding workload identities and token revocation.
- **Silos Inhibit Defense:** Organizational silos prevented the government entity from coordinating an effective response.
## Recommendations
- **Implement Conditional Access:** Enforce Microsoft Conditional Access or similar tools for all workload identities.
- **Token Management:** Establish automated processes to revoke compromised access and refresh tokens immediately upon detection.
- **EDR Tuning:** Periodically review and tune EDR rules to reduce false positives, ensuring high-severity alerts are not missed.
- **OT Segmentation:** Ensure strict isolation between IT business systems and OT DMZ environments.