I'm not a huge fan of how red teaming is generally conducted. It's sometimes necessary, but the CISA report seems to indicate that the organization wasn't responding to their requests the way they wanted, leading to a communication breakdown right from the start. The vulnerability was patched and the red team's initial compromise was contained, so they targeted them with phishing, owned their domain controllers, then maintained access for months while pivoting to partner organizations, then published a public report.

It's hard to establish constructive dialogue after that, allot of bad feelings and burnt bridges - and sometimes HR. It's tough because there's generally allot of dynamics at play, but I'm sure the impact of this testing was felt by people within the targeted org.