CISA Red Team Breaches Two Critical Infrastructure Organizations Revealing Stark Differences in SOC Effectiveness

CISA published an advisory on August 25 detailing two simultaneous, unnamed red team assessments using nearly identical tradecraft against a Government Services and Facilities Sector organization (Organization A) and a Water and Wastewater Systems Sector organization (Organization B) 1. In both cases the red team gained initial access via phishing, then exploited a default Machine Account Quota and misconfigured Active Directory Certificate Services templates to escalate privileges and reach sensitive business systems and cloud resources 12. Organization A's SOC did not detect the intrusion, allowing the team to read SOC staff emails and deploy keyloggers on defenders' machines undetected. CISA attributed this to multiple uncoordinated SOCs, thousands of false-positive alerts, and no defined escalation procedures 12. Organization B's SOC isolated compromised workstations within 2 to 20 minutes of the phishing payload executing and later blocked a suspicious Azure sign-in and isolated a compromised OT-zone bastion host after CISA moved to an "assume breach" model 13. CyberScoop identified Organization A as a government entity and Organization B as a water utility; CISA did not name either organization 3.