# CISA Broke Into a US Federal Agency, No One Noticed For a Full 5 Months

**URL:** <https://onehack.st/t/cisa-broke-into-a-us-federal-agency-no-one-noticed-for-a-full-5-months/286807>\
**Category:** News & Articles\
**Created:** [July 13, 2024, 8:11am UTC](https://onehack.st/t/cisa-broke-into-a-us-federal-agency-no-one-noticed-for-a-full-5-months/286807 "2024-07-13T08:11:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [July 13, 2024, 8:11am UTC](https://onehack.st/t/cisa-broke-into-a-us-federal-agency-no-one-noticed-for-a-full-5-months/286807/1 "2024-07-13T08:11:49Z")

</div>

**Summary:**

1. A 2023 CISA red team exercise exposed critical security failings in a US federal agency, leading to a full domain compromise.

2. The team exploited an unpatched vulnerability, conducted phishing attacks, and found weak passwords and unsecured credentials, gaining access to tier zero assets.

3. The agency failed to detect or remediate malicious activity for five months, highlighting the need for defense-in-depth principles and improved security measures.

[Read more on The Register](https://theregister.com)