CISA broke into a US federal agency, and no one noticed for a full 5 months

CISA's 2023 SILENTSHIELD red team assessment of an unnamed federal agency exploited CVE-2022-21587 in an Oracle Solaris enclave to gain RCE, later achieved Windows domain admin via successful phishing, plaintext credentials on an open admin share, and kerberoasting, injected a persistent RAT, and pivoted into trusted partner organizations; the exercise exposed slow patching, ineffective log collection and detection, and a need for defense-in-depth and better vendor security practices.