CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
- ID
- 18210
- Status
- summarized
- Published
- 26 Aug 2026, 9:07 PM
- Fetched
- 26 Aug 2026, 11:40 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 26 Aug 2026, 11:44 PM
- Tags
- Audience
- developersdatabase_learnerssaas_founders
What happened
CISA published results of two simultaneous red team assessments against critical infrastructure orgs, both fully compromised at the domain level. Organization A (government services) detected nothing despite the red team using default web app credentials, AD CS template abuse (Certighost class), cleartext DB credentials, static never-expiring AWS keys, and stolen Entra ID tokens to read the security team's email. Alert fatigue from thousands of false positives, siloed SOCs with no shared visibility, and analysts lacking escalation authority all contributed to total blind spot.
Why it matters
The specific failures here are a concrete checklist for any team running AD, AWS, and Entra ID: hunt for default credentials on built-in accounts, audit AD CS templates for the Certighost-class misconfiguration, eliminate cleartext credentials in DB config files, rotate static AWS keys that never expire, and reduce false-positive alert volume so real intrusions surface. If you operate a SOC or multiple security tools with no shared visibility, this advisory is your blueprint for what will go wrong.
Discussion angle
Walk through the chain of failures at Organization A and ask: which of these exact misconfigurations exist in our own infrastructure right now — default creds, cleartext DB config, static AWS keys, AD CS template abuse, or alert noise drowning out real signals?