[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVw8OqddRozwo7HMDaHwH0vBI2n7qDaww0piNMLXTX_k":3},{"article":4,"iocs":52,"watch_terms":81,"solutions":82,"lesson":171},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e6e529d7-b97d-4cad-b71f-bc3f4d666300","CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing","cisa-red-team-compromised-two-critical-infrastructure-orgs-one-detected-nothing-1c8cb4","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the results of two red team assessments it conducted simultaneously against two critical infrastructure organizations, using what it described as similar tradecraft while recording sharply different defensive outcomes. Both organizations were fully compromised at the domain level, and in both, the red team also","CISA published results of simultaneous red team assessments against two critical infrastructure organizations using similar attack techniques with drastically different outcomes. Organization A failed to detect any compromise despite full domain takeover and cloud access via misconfigurations (default credentials, AD CS abuse, cleartext credentials, overpermissioned Entra ID apps), while Organization B detected and isolated phishing payloads within 2–20 minutes, preventing lateral movement. Both organizations shared underlying weaknesses including cleartext credential storage, static cloud access keys, and misconfigured Active Directory services.","CISA red team fully compromised two critical infrastructure orgs; one detected nothing, the other responded in minutes.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcisa-red-team-compromised-two-critical.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhW3w9bF-wcalV_4xeymOZiHzRSkeBfz8Vh1B58JkthAgonYo-DGr3kWwNQ8ia760jX1kfC7NTkitD9rWxJNSNzMZWTAVWqrmJQXL7-1rOHbmC7mKSmfArdBAp5s4phuF3SlKr20agmwKrpI56a9SijzuYLnhYlb3R4l7uhb4S0Na0d3_OplvHmbC1EDCk\u002Fs1600\u002Fcisa-hack.jpg","2026-08-26T13:07:02+00:00","2026-08-26T16:00:30.660923+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":24},"Active Directory Certificate Services","product",{"name":26,"type":24},"Entra ID",{"name":28,"type":24},"System Center Configuration Manager",{"name":30,"type":19},"Amazon Web Services","c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73",{"id":31,"icon":33,"name":34,"slug":35},null,"Incident Response","incident-response",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60,63,66,69,72,75,78],{"type":54,"value":55,"context":56},"mitre_attack","T1078.004","Default credentials abuse on web application",{"type":54,"value":58,"context":59},"T1566.002","Phishing with internal email address spoofing",{"type":54,"value":61,"context":62},"T1548.004","Abuse of default Machine Account Quota for privilege escalation",{"type":54,"value":64,"context":65},"T1649","AD CS certificate template abuse (ESC1, Certighost-style)",{"type":54,"value":67,"context":68},"T1040","Network sniffing of cleartext credentials in configuration files",{"type":54,"value":70,"context":71},"T1528","Theft of AWS access keys and Primary Refresh Tokens from cloud",{"type":54,"value":73,"context":74},"T1550.001","Use of stolen credentials to access sensitive business systems and cloud",{"type":54,"value":76,"context":77},"T1110.001","Brute force \u002F default credential enumeration on web application",{"type":54,"value":79,"context":80},"T1003.001","DCSync attack to retrieve krbtgt secret from domain controller",[21,30,18],{"controls":83,"vendors":167},[84,112,138],{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,96,104],{"vendor_slug":90,"vendor_name":21,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":113,"name":114,"problem":115,"products":116},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[117,125,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":90,"vendor_name":21,"vendor_logo":91,"product_slug":126,"product_name":127,"url":128,"description":129},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":139,"name":140,"problem":141,"products":142},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[168],{"slug":90,"name":21,"logo_path":91,"roles":169},[170],"affected",{"slug":172,"title":173,"body":174,"framework_refs":175,"framework_notes":189},"red-team-exposes-how-detection-gaps-lead-to-full-domain-compromise","Red Team Exposes How Detection Gaps Lead to Full Domain Compromise","CISA's simultaneous red team assessments revealed that default credentials, misconfigured Active Directory Certificate Services, and overpermissioned cloud applications allowed full domain takeover of Organization A — which detected nothing throughout the entire engagement. Organization B's swift detection and containment within 2–20 minutes demonstrated that the same attack techniques can be effectively neutralized when mature monitoring and response capabilities are in place. The core failure in Organization A was not a lack of patches alone, but a compounding of poor configuration hygiene with zero visibility into attacker activity. This matters because critical infrastructure organizations face nation-state and sophisticated threat actors who actively exploit exactly these misconfigurations, and undetected compromise can persist for months. The contrast between the two organizations is a stark reminder that security controls are only as effective as the organization's ability to detect when they fail.",[176,177,178,179,180,181,182,183,184,185,186,187,188],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 CM-6 – Configuration Settings","NIST SP 800-53 IR-4 – Incident Handling","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF RS.RP-1 – Response Plan Execution","MITRE ATT&CK T1649 – Steal or Forge Authentication Certificates (AD CS)","MITRE ATT&CK T1078 – Valid Accounts (Default Credentials)",{}]