You're listening to the CyberWire Network, powered by N2K.

This is a CISA Cybersecurity Alert.

ID number Alpha, Alpha 23 TAC 059

Alpha. Original release date, February 28, 2023.

In 2022, SISA conducted a Red Team assessment

at the request of a large critical infrastructure

organization with multiple geographically separated sites.

The team gained persistent access to the organization's network, moved laterally across the organization's multiple

geographically separated sites, and eventually gained access to systems adjacent to the

organization's sensitive business systems.

Multifactor authentication prompts

prevented the team from achieving success to one sensitive system,

and the team was unable to complete its viable plan

to compromise a second sensitive system within the assessment period.

Despite having a mature cyber posture, the organization did not detect the Red Team's activity

throughout the assessment, including when the team attempted to trigger a security response.

CISA is releasing this advisory detailing the Red Team's tactics, techniques, and procedures

and key findings to provide network defenders of critical infrastructure organizations proactive steps to reduce the threat of similar activity from malicious actors.

This advisory highlights the importance of collecting and monitoring logs for unusual activity and continuous testing and exercises

regardless of the maturity of your cyber posture.

The advisory documentation listed in the show notes includes additional technical details,

TTPs, and a complete outline of the red team exercise with a mitre attack mapping.

...