CISA’s Red Team Exercise Shows Value of Phishing, but Misses the Best Recommendation

A CISA red team conducted a prolonged attack simulation against a federal civilian agency: they exploited an unpatched Solaris vulnerability, then used OSINT-driven spear-phishing to deploy an in-memory backdoor, bypass defenses, compromise SCCM and administrative jump servers, maintain months-long undetected persistence, and exfiltrate gigabytes of data—highlighting failures in patching, monitoring, MFA adoption, and user awareness training.