CISA RED TEAM COMPROMISED TWO CRITICAL INFRASTRUCTURE ORGS, ONE DETECTED NOTHING

Summary from the TLDR InfoSec newsletter

CISA's red team gained domain-level access at two critical-infrastructure organizations. One organization missed the intrusion amid false positives, disconnected SOC tooling, default credentials, AD CS flaws, cleartext secrets, and permanent AWS keys. The other organization isolated phishing-hit workstations within 2–20 minutes, yet assessors later obtained domain-controller secrets through an SCCM-stored service credential.