CISA red team breaches government and water networks; water utility detects attack

AI digestMimile.ai EditorialAugust 25, 2026 at 10:11 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

CISA red team breaches government and water networks; water utility detects attack

CISA red teamers gained initial access to both a government organization and a water utility during a simulated attack, but only the water utility detected and quarantined the compromise. The government organization failed to respond to endpoint alerts, allowing the red team to move laterally to sensitive business systems and cloud resources.

Key Facts

CISA red teamers gained initial access to both a government organization and a water utility, but only the water utility detected and quarantined the compromise.
At the water utility, three users clicked a malicious link, and the security operations center quarantined affected workstations in 2, 10, and 20 minutes.
At the government organization, red teamers used an internal email address for phishing, gained elevated privileges, and moved laterally to sensitive business systems and cloud resources undetected.
CISA faulted the government organization's security operations center for not responding to low- and medium-severity endpoint detection and response alerts, with thousands of false positives obscuring red team activity.

Red Team Exercise

CISA published a rare public report on its red-team activities on Tuesday, detailing tests against two unnamed organizations—one in the government sector and one in the water sector. The agency conducted the tests through a voluntary, by-request process. In the government organization, red teamers used an internal email address to send phishing emails, gained elevated privileges, and moved laterally to sensitive business systems and cloud resources undetected. The water utility detected the initial compromise after a spearphishing campaign convinced three users to click a malicious link.

Defensive Response

The government organization's security operations center received low- and medium-severity endpoint detection and response alerts but did not respond to them. CISA attributed the failure to thousands of false positives, including some with higher severity, that obscured alerts triggered by red team activity, as well as organizational silos. The water utility's security operations center triaged alerts and quarantined affected workstations in 2, 10, and 20 minutes respectively. After the water utility detected the compromise, the red team moved to an 'assume breach' model, with trusted agents providing access to a host replicating the level of access the red team would have had if defenders had not detected the activity.

1 source

CISA red team breaches government and water networks; water utility detects attack

cyberscoop.com

CyberScoop

Technology

CISA Red Team Compromises Two Critical Infrastructure Orgs, One Detects Nothing

CISA's red team compromised two critical infrastructure organizations at the domain level during simultaneous assessments, reaching sensitive business systems and cloud resources in both. Organization A, a Government Services and Facilities Sector entity, detected none of the activity, while Organization B, a Water and Wastewater Systems Sector entity, detected some but not all. The advisory, AA26-237A, was released on August 25, 2026.

Technology

CISA warns hackers exploit critical MLflow SSRF flaw CVE-2026-64849

CISA on Wednesday added CVE-2026-64849, a critical SSRF flaw in MLflow, to its known exploited vulnerabilities catalog and ordered U.S. federal civilian agencies to patch within two weeks. watchTowr said attackers began scanning for MLflow systems within hours of the CVE assignment and are using it to reach cloud metadata services and steal credentials.

Politics

Mojave Research: 12 Vulnerabilities in Dominion Voting Systems, No Exploitation Evidence

Mojave Research found at least a dozen high- or critical-severity software vulnerabilities in Dominion voting systems used in Puerto Rico’s 2024 elections, but no evidence any were exploited. The Trump administration shut down the firm’s election-security work after its findings did not support claims of manipulation. The shutdown followed federal requests to expand the team from about 10 to 60 people.

Technology

CISA warns Minnesota water cyberattackers likely hold only control logic backups

More than 30 Minnesota community water systems lost remote control and had critical control logic stolen during coordinated cyberattacks on July 26–27, a new CISA advisory reveals. Attackers exfiltrated PLC project files from Rockwell MicroLogix 1400 controllers, potentially holding the only current backups of plant operations for utilities that lack offline copies.

CISA red team breaches government and water networks; water utility detects attack

Key Facts

Red Team Exercise

Defensive Response

Read more

Read more