CISA conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems and cloud resources. This advisory details the red team's activity and organizations' defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology environments.

This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.

The program brings together five managed detection and response providers to deliver cyber services to utilities serving fewer than 10,000 people, which account for 91% of the country's approximately 50,000 community water systems. The initiative aims to help under-resourced utilities improve cyber defenses, identify attacks and mitigate breaches, while creating a scalable model to address cybersecurity challenges facing the nation's water sector.