CISA's red team logged into a water utility's OT jump server with credentials from an FTP service
A fast SOC cut off the intrusion in minutes. The red team still reached the domain controller and the control network, because every control that failed afterwards was a permission somebody granted and nobody had reviewed.
The Product Desk
What happened
- CISA published advisory AA26-237A on August 25, 2026, covering two simultaneous red team assessments at consenting critical infrastructure organizations, one in government services and one a water and wastewater utility.
- Three staff at the water utility clicked spearphishing emails, and its SOC isolated all three workstations within two, 10 and 20 minutes, cutting off the red team's command and control.
- Before the last of those isolations, the red team had already run LDAP queries and copied the domain: users, groups, computers, group policy objects and the relationships between them.
- The sole route into the utility's control network, a bastion host in the OT DMZ, admitted the red team on FTP credentials used over SSH.
- At the government services organization, the EDR alerted on red team activity correctly and more than once, and analysts closed those alerts as false positives or never opened them.
Why it matters
- constraint Every control that held at the utility acted after a step had already landed, which puts a ceiling on what a fourth alert source can recover once the domain map is out of the building.
- cost Two of the three actions SafeBreach puts first carry no licence fee, so the bill lands on whoever owns the deployment pipeline and the delegation model rather than on the security tooling budget.
- contradiction trout.software leaves the utility with every mailbox readable from the internet while TechTarget has the SOC blocking the cloud login and isolating the OT DMZ host, which changes how much credit "caught them fast" earns.
- precedent An advisory with nothing to patch and no adversary to block sets the expectation that the response is firing the technique into your own environment and watching what the stack does.
The alert that stopped a federal red team at the water utility was called "An executable file loaded an unexpected DLL file" [3]. Medium severity, dull name, the kind of thing most shops route to a queue nobody opens. It worked because a human read all three of them and could pull a machine off the network without asking permission first [4].
That is the ceiling of what detection bought. Both organizations still ended fully compromised [2]. trout.software's read of the advisory sorts the utility's controls into two piles: the ones that held were alerting, egress filtering and host isolation, and each of them caught the red team only after a step had already succeeded [16]. The ones that failed describe permissions somebody granted. A machine account quota of 1,000 for every domain user [5]. A domain service account password sitting in cleartext in an XML file, found by enumerating SCCM distribution points [14]. That same account holding AllExtendedRights over a domain controller plus control of nearly 1,000 other accounts, which the team turned into DCSync and a krbtgt dump [15]. And a jump server that opened to a password borrowed from another service [17]. Three controls that alert, four that grant [23].
The quota is the cheapest thing on that list to check. TechTarget notes that Active Directory's default lets a non-admin create up to 10 machine accounts [7]; the utility was sitting at 1,000, a hundred times the default [21]. Nothing was attacked to get there. The team created an account with a plausible-looking name, took the domain identity and password that came with it, and proxied its tooling through the compromised host from its own Linux box, outside the endpoint agent's view [5]. No exploit appears anywhere in that chain [22].
The two readings diverge at the ending. trout.software has the team finishing the assessment able to read every user's email from the public internet [18]. TechTarget's account of the same advisory has Organization B's SOC isolating the host in the OT DMZ and blocking the red team's cloud login after an automated Microsoft alert on cleartext Entra ID Connect credentials [6]. SafeBreach's one-line summary of both organizations survives either version: opposite endpoint detection maturity, identical cloud identity gaps [20].
SafeBreach's do-this-first list is worth reading in the order it was written: tune the detection baseline, then set Machine Account Quota to zero, then fix the ADCS certificate templates [19]. Item one is the other organization's problem, where a default quota and an ESC1-misconfigured certificate template together handed an unprivileged domain user a certificate for any identity in the domain [10]. Items two and three cost a change ticket and an argument with whoever owns deployment.
The sort that makes this usable on Monday has two columns. Column one tells you a step already succeeded, while column two makes that same step impossible. Detection sits in column one by construction, and at the utility column one performed [16]. Column two is four questions with a query behind each: what the machine account quota is set to, which service accounts hold extended rights on a domain controller, which passwords are in the files the deployment server hands out, and whether the only door into OT accepts a credential that exists somewhere else. None of the four needs a purchase order. The awkward part is that the person who can answer them does not work in the SOC.
What to watch
- Whether the full advisory settles Organization B's endgame: mailboxes readable from the public internet, or a cloud login the SOC blocked.
- Whether water-sector funding conditions or audits start naming the advisory's Validate Security Controls step as a requirement.
- Whether the next published CISA assessment reports a machine account quota figure, giving a second data point on how far above default utilities run.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption36
- Hype gap−6
- Incentives66
- Confidence78
Perspective Coverage
3 publishers- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA published advisory AA26-237A on August 25, 2026, covering two red team assessments run at the same time, both requested by the organizations involved; Organization A is in the Government Services and Facilities Sector and Organization B is a water and wastewater utility.
- [2]
The advisory is titled "A Tale of Two SOCs: Insights From Two Red Team Assessments"; CISA's red team reached full domain compromise at both organizations, assessed under 6 U.S.C. authority in live production environments.
- [3]
At the water utility the red team collected employee email addresses from public websites and sent spearphishing emails; three people clicked, and each payload set off a medium-severity alert named "An executable file loaded an unexpected DLL file."
- [4]
SOC staff at the water utility looked at all three alerts and isolated the workstations within 10, 2 and 20 minutes, cutting off the red team's command and control; per trout.software it worked because someone read the alert and could pull a machine off the network without asking permission first.
- [5]
The machine account quota at the water utility was 1,000 for every domain user; the team created a machine account with a legitimate-looking name, gained a domain account and password it controlled, and ran tools from its own Linux box proxied through the internal host, putting it outside the reach of the endpoint agent.
- [6]
TechTarget reports that Organization B's SOC successfully isolated the host in the OT DMZ, and that the red team's attempt on the organization's cloud systems using cleartext Entra ID Connect credentials was stopped when an automated Microsoft alert prompted the SOC to block the suspicious login.
- [7]
TechTarget reports that Organization A's escalation used Machine Account Quota, an Active Directory setting that by default permits non-admin users to create up to 10 accounts in a domain, plus misconfigured AD Certificate Service templates; initial access came from an app with default credentials that let the team send phishing from an internal email address.
- [8]
CISA attributed Organization A's failure to respond to low- and medium-severity EDR alerts to alert fatigue, organizational silos and insufficient alert escalation procedures.
- [9]
Organization A's EDR generated alerts on red team activity correctly, more than once; they were closed as false positives or never opened, buried under thousands of others from routine business operations, many rated more severe.
- [10]
The chain SafeBreach highlights: a default Machine Account Quota plus an ESC1-misconfigured ADCS template took an unprivileged domain user to a certificate for any identity in the domain, and neither misconfiguration is exotic.
- [11]
AA26-237A contains no IOCs, no threat actor to attribute and no malware family; the red team used BloodHound, AzureHound, ROADrecon and Rubeus, four tools any defender can download.
- [12]
Before isolation, from one workstation the red team ran LDAP queries and pulled the whole domain: users, groups, computers, GPOs and the relationships between them; twenty minutes was enough to get the map.
- [13]
The assessment then switched to an assume breach model: utility staff who knew about the test ran a red team payload on a chosen internal host under a standard user account with no admin rights.
- [14]
Enumerating SCCM distribution points turned up an XML file containing the cleartext password for a domain service account.
- [15]
That service account had AllExtendedRights over a domain controller plus control over almost 1,000 other accounts; the team used a resource-based constrained delegation attack to obtain DCSync and dumped credentials including krbtgt.
- [16]
trout.software's analysis finds the controls that worked at the utility were alerting, egress filtering and host isolation, all of which caught the red team after a step had already succeeded, while the ones that failed were about who is allowed to do what: a service account with rights over a domain controller, a cleartext password in an XML file, a machine account quota of 1,000, and a jump server that opened to a password borrowed from another service.
- [17]
The red team found an IT workstation with saved RDP files, one named ics-[redacted]-org, which could reach the bastion host that CISA describes as the sole access point between the IT network and the OT environment; they logged into it using FTP credentials over SSH.
- [18]
According to trout.software, the red team took over the domain, got onto the jump server in the OT DMZ, and finished the assessment able to read every user's email from the public internet.
- [19]
SafeBreach's stated first actions on the advisory are: tune your detection baseline, then set Machine Account Quota to zero and fix your ADCS certificate templates.
- [20]
SafeBreach summarises the finding that applies to both organizations as "opposite endpoint detection maturity, identical cloud identity gaps."
- [21]
The water utility's machine account quota of 1,000 is 100 times the Active Directory default of 10 accounts per non-admin user.
- [22]
trout.software states the post-foothold escalation at the utility proceeded "still without exploiting anything," and that none of the three findings is something monitoring would catch.
- [23]
Of the controls trout.software names at the water utility, three worked and all three were detection or containment measures, while four failed and all four were permission or stored-secret settings.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
3 independent publishers whose own reporting we read for this story.
- CISA AA26-237A: The Advisory With Nothing to Patch | SafeBreach
safebreach.com
1 article · September 7, 2026
- techtarget.comCISA red team reveals why some SOCs fail and others succeed | TechTarget
1 article · September 7, 2026
- CISA Red Team AA26-237A: The OT Jump Server Still Fell
trout.software
1 article · September 7, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.