CISA Red Teamed Two Critical Infrastructure Orgs at Once: One SOC Saw Nothing

TL;DR

• what: CISA advisory AA26-237A, released August 25, 2026, details two simultaneous red team assessments against a Government Services and Facilities Sector organization and a Water and Wastewater Systems Sector utility using similar tradecraft.

CISA published advisory AA26-237A on August 25, 2026, titled "A Tale of Two SOCs." It documents two red team assessments run at the same time, against two critical infrastructure organizations, using similar tradecraft. Both organizations were compromised at the domain level. In both, the red team reached sensitive business systems and cloud resources. The difference between them was not the attack. It was whether anyone noticed.

---

Originally published on RedEye Threat Intelligence.