CISA red team assessments fully breached two critical infrastructure organizations, and only the water utility noticed.
Iran-linked actors are the leading suspects in a campaign that has hit at least 12 states since late July.