CISA Red Team Took Over Critical Infrastructure. One SOC Barely Saw It
- The Mess: CISA’s latest red-team assessment shows just how quickly attackers can move when basic identity and cloud security controls are weak. In one simulated critical-infrastructure environment, the red team progressed from initial access to domain administrator and cloud access, while the organization’s security monitoring generated little useful detection. The exercise exposed problems including default credentials, plaintext passwords, weak Active Directory Certificate Services configurations and exposed cloud credentials.
This isn’t a CVE.
There isn’t a patch you can install.
And that’s precisely why it’s worth paying attention to.
CISA’s assessment shows what happens when an attacker gets inside an environment where identity, Active Directory and cloud controls haven’t been properly hardened.
The red team didn’t need some mythical zero-day.
They found things defenders already know they’re supposed to eliminate:
default passwords.
credentials stored in plaintext.
misconfigured Active Directory Certificate Services.
static AWS credentials.
And then they chained those weaknesses together.
That’s the part organizations consistently underestimate.
One bad configuration may not be catastrophic.
Five of them connected together can be.
The attackers didn’t need anything exotic
The simulated attackers initially obtained access through exposed systems and then began mapping the environment.
From there, they discovered credentials and weaknesses that allowed them to move laterally.
One of the biggest problems was Active Directory Certificate Services (AD CS).
Misconfigured certificate templates can allow attackers to obtain certificates that effectively provide another route to authenticate as privileged accounts.
In this assessment, the red team was able to abuse certificate infrastructure to escalate privileges.
This is an important lesson because AD CS attacks don’t always look like traditional credential theft.
There’s no obvious:
“Administrator password cracked.”
Instead, the attacker abuses the organization’s own certificate infrastructure.
The system issues the attacker something that looks legitimate.
And now the attacker can authenticate.
Then they found passwords lying around
CISA also identified plaintext credentials during the exercise.
That’s one of those findings that makes security teams uncomfortable because it isn’t sophisticated.
It doesn’t require advanced malware.
It doesn’t require AI.
It doesn’t require a zero-day.
It requires somebody to have saved a password somewhere they shouldn’t have.
The red team found credentials in places such as scripts and configuration data and used them to move further into the environment.
This is why credential hygiene remains one of the most important defensive controls.
You can have EDR.
You can have SIEM.
You can have a million-dollar SOC.
If an attacker finds:
password = ********
inside a script, your fancy security stack may not matter very much.
AWS credentials were another problem
The assessment also found static AWS credentials that provided access to cloud resources.
This is where the attack moved from traditional infrastructure toward the cloud.
An attacker who obtains valid cloud credentials doesn’t necessarily trigger the same alerts as someone running malware.
The cloud sees a valid authentication attempt.
The credentials are real.
The API request is technically legitimate.
The problem is the person using them.
That is why cloud identity monitoring has become so important.
The question isn’t simply:
“Did someone log in?”
It’s:
“Did the right identity perform the right action from the right place?”
The SOC problem was almost as bad as the compromise
And this is the part that really caught my attention.
In one environment, the defenders had security monitoring.
They had alerts.
They had a SOC.
But the red team still managed to progress significantly before being stopped.
Why?
Because alerts aren’t the same thing as detection.
If your SOC receives thousands of low-value alerts every day, analysts eventually spend their time processing noise.
Meanwhile, the attacker is doing something much more important:
moving toward Domain Admin.
CISA’s assessment highlights the difference between having security tooling and actually being able to use that tooling effectively.
Another organization performed much better
The report isn’t entirely depressing.
A second assessed organization demonstrated much stronger defensive capabilities.
The red team’s activity was detected.
Endpoints were isolated.
The organization responded rapidly.
In several cases, defenders detected malicious activity within minutes, rather than discovering it after the attackers had already achieved their objectives.
That’s the difference between:
“We have a SOC.”
and
“Our SOC works.”
You don’t necessarily need to detect every event.
You need to detect the events that matter.
The Fix
CISA’s recommendations are remarkably practical:
- eliminate default credentials;
- remove plaintext passwords from scripts and configuration files;
- implement phishing-resistant MFA;
- harden AD CS;
- rotate exposed cloud credentials;
- use short-lived cloud credentials instead of static keys;
- restrict privileged accounts;
- improve endpoint telemetry;
- reduce SIEM false positives;
- continuously test detection capabilities;
- perform regular adversary simulations.
And most importantly:
test the defenses yourself.
Don’t wait for an actual attacker to tell you whether your SOC works.
Hire a red team.
Run attack simulations.
Try to obtain Domain Admin.
Try to access cloud infrastructure.
Try to steal credentials.
Then see what happens.
If nobody notices?
That’s your finding.
Bugstoday Opinion
This report is arguably more useful than another CVSS 9.8 vulnerability.
Why?
Because there’s no patch.
The vulnerabilities here were organizational.
Default passwords.
Poor credential storage.
Misconfigured certificates.
Static cloud keys.
Alert fatigue.
Weak detection.
None of those problems disappear because you installed the latest Windows update.
And attackers love environments like this.
They don’t need to find a zero-day if the administrator accidentally leaves the keys on the desk.
Bugstoday verdict: the most dangerous vulnerability in your network might not have a CVE number. If a red team can reach Domain Admin using ordinary credentials, misconfiguration and identity abuse — and your SOC doesn’t notice — the problem isn’t your lack of security tools. It’s your lack of security control.
