CISA's red team ran the same playbook against two American critical infrastructure organizations at the same time. In both, it took over the entire Windows domain and reached the systems each organization had named as its most sensitive. The difference was what the defenders did about it. At one, staff caught the very first payload and pulled the affected machines off the network in 10, 2 and 20 minutes. At the other, nobody responded at all, and the red team ended up reading the security team's email to check whether anyone had noticed.
That comparison is the point of the advisory CISA published on August 25, catalogued AA26-237A. Running two assessments at once, against a government services body (Organization A) and a water and wastewater operator (Organization B), gave the agency something it rarely gets: two security operations centers under identical pressure.
Default passwords, then a certificate for anyone
At Organization A the way in was mundane. A web application was still running with default credentials on several built-in accounts, which let the team send email from an internal address. Phishing from a trusted internal sender got them onto four workstations, where they ran BloodHound, an open-source Active Directory mapping tool, modified to slip past the endpoint software's signatures.
Two defaults did the rest. The domain still allowed ordinary users to register up to ten computer accounts, and the certificate service carried templates with an ESC1 misconfiguration, which lets any user request a certificate in someone else's name. The team registered a machine account, minted certificates for privileged accounts, and owned the domain. After that, credentials were lying around: cleartext passwords on an administrator's workstation, saved database connection files, long-lived AWS keys that had never been set to expire.
The cloud apps nobody was watching
The Entra ID stage is the part most organizations will recognize least. Instead of attacking user accounts, the red team targeted applications holding what Microsoft calls Application permissions, which let software read data without any user consenting and sit outside the conditional access rules most organizations rely on. Using the public tools AzureHound and ROADrecon, the team found an application allowed to read and write Outlook mail, moved to its owner's machine, stole that user's primary refresh token, and used it to add a new secret to the application. Impersonating the app, they read mail through the Microsoft Graph API, including the SOC's own. CISA notes its red team has never observed an organization using Conditional Access for workload identities, the control that would have blocked this.
The alerts arrived. Nobody acted.
Organization A's tools were not blind. The SOC received medium and low severity alerts on the activity and did not action them, because thousands of false positives from ordinary business operations, many rated higher, were burying them. The organization ran several SOCs on several endpoint products whose teams could not see each other's consoles. In one exchange the red team watched, defenders investigating a server could not establish who owned it or what it did, and closed the alert as a false positive.
Organization B got a plainer alert: an executable had loaded an unexpected DLL, rated medium. Staff triaged it and isolated all three affected workstations, cutting the command and control channel. The red team had to fall back to an assume breach model, and defenders still caught them again later at the bastion host bridging into the operational technology network. Note the ceiling, though. Organization B lost its domain anyway, to a service account password sitting in cleartext in an SCCM configuration file. Detection is not prevention. It is the difference between an incident and a catastrophe.
Tune the noise, then empower the defenders
CISA's recommendations track the failures. Establish and maintain a baseline so alert filtering works. Break down silos and give network defenders real authority. Apply conditional access to workload identities and audit applications for excessive or unused permissions. And write, then rehearse, a procedure for revoking access and refresh tokens after a cloud compromise. Intruders leaning on valid credentials rather than malware is the same pattern state-linked groups have settled into, and it is why US critical infrastructure operators keep finding that their alerting worked and their response did not.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.