CISA Red Team Pwns Two Critical Orgs — One SOC Missed Everything

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed the results of two simultaneous red team assessments against critical infrastructure organizations, revealing that both were fully compromised at the domain level — yet only one of the targets failed to notice. The advisory, tracked as AA26-237A and titled "A Tale of Two SOCs," was published on August 25, 2026, and underscores how defensive maturity — not just tooling — determines whether an intrusion is caught.

Against Organization A, a Government Services and Facilities Sector entity, the red team gained initial access through a web application running with default credentials on built-in accounts. From there, attackers pivoted to internal phishing, landing on four workstations before escalating privileges by chaining a default Machine Account Quota with a misconfigured Active Directory Certificate Services (AD CS) template — the same ESC1-class abuse behind the recently surfaced Certighost domain-takeover exploit. The team later pivoted into three sensitive business systems using cleartext credentials harvested from decrypted database configuration files and static AWS access keys configured never to expire. In the cloud, a stolen Primary Refresh Token was used to abuse over-permissioned Entra ID applications, allowing the red team to read security team emails and monitor whether defenders were tracking the activity. Organization A's security operations centers ran multiple endpoint and monitoring tools with no shared visibility, and thousands of high-severity false positives drowned out the genuine alerts — including one tied to activity on an SCCM server that was dismissed as a false positive after analysts could not identify its owner.

CISA flagged the dominant enablers as default Machine Account Quotas, misconfigured AD CS certificate templates allowing requests for any user, cleartext service and database credentials on reachable systems, non-expiring static cloud access keys without revocation, and over-permissioned Entra ID applications. Network defenders can validate their own AD CS hygiene and exposed certificate templates, then run a quick port scan to confirm no unexpected services are reachable from the internet. Organizations should also review cloud identity posture immediately, as the AWS and Entra ID weaknesses exploited here remain common across enterprises.

The lesson, per CISA, is operational rather than technical: detection pipelines saturated by false positives, fragmented SOC tooling, and analysts without authority to escalate will fail regardless of how many products are deployed. Organizations unsure about their credential exposure can use a password checker to verify the strength of privileged accounts, while broader exposure reviews — including email account compromise — can be confirmed with an email breach checker to ensure the same cleartext credential patterns aren't replayed in future attacks.