CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
Summary: CISA published advisory AA26-237A, "A Tale of Two SOCs," on August 25, 2026, describing two simultaneous red team assessments against a Government Services and Facilities Sector organization and a Water and Wastewater Systems entity, both fully compromised at the domain level along with sensitive business systems and cloud resources. Organization A detected nothing, its alerts buried under thousands of higher-severity false positives from normal business operations and split across multiple SOCs and endpoint tools with no shared visibility, while Organization B's SOC detected the initial phishing payloads as they executed and isolated affected workstations within 2 to 20 minutes.
Key Takeaway: Organization A's one real alert, on an SCCM server, was dismissed as a false positive because defenders could not identify the system's owner - the intrusion was found by no one. CISA attributed the gap between the two outcomes to the people and processes running the tools, not the tools themselves.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026