A Tale of Two SOCs: Insights From Two Red Team Assessments

CISA advisories describe active and emerging cyber threats affecting critical infrastructure, including full-domain compromise observed in red-team assessments, ransomware, exploitation of Siemens and other PLCs, Russian state-supported targeting of Zimbra and vulnerable network devices, China-nexus compromised-device networks, and Iranian-affiliated attacks on internet-exposed OT. Recommended defenses include asset inventory, patching, removal of internet exposure, strong access controls, network segmentation, tuned detection, incident-response coordination, threat hunting, and immutable/offข