CISA Red Team Fully Compromised Two Critical Infrastructure Orgs

CISA performed simultaneous red team exercises against two critical-infrastructure organizations and achieved full domain and cloud compromises in both environments. The report highlights exploited weaknesses including default credentials, a misconfigured ADCS template (ESC1), exposed SCCM and AWS credentials, DCSync/Golden Ticket attacks, and missing Conditional Access for workload identities; it contrasts Organization A’s failure to detect or respond with Organization B’s more effective containment and lists practical mitigations.