Post

🧵 THREAD: A federal whistleblower just dropped one of the most disturbing cybersecurity disclosures I’ve ever read. He's saying DOGE came in, data went out, and Russians started attempting logins with new valid DOGE passwords Media's coverage wasn't detailed enough so I dug into his testimony:

Who’s the whistleblower? Daniel Berulis — a senior DevSecOps architect at the National Labor Relations Board (NLRB), formerly with TS/SCI clearance. He just told Congress the Department of Government Efficiency (DOGE) pulled off a covert cyber op inside a federal agency.

DOGE demanded root access. Not auditor access. Not admin. They were given “tenant owner” privileges in Azure — full control over the NLRB’s cloud, above the CIO himself. This is never supposed to happen.

They disabled the logs. Berulis says DOGE demanded account creation with no recordkeeping. They even ordered security controls bypassed and disabled tools like network watcher so their actions wouldn’t be logged.

503 reposts2.2K likes

And then the data started flowing out. 10+ GB spike in outbound traffic Exfiltration from NxGen, the NLRB's legal case database No corresponding inbound traffic Unusual ephemeral containers and expired storage tokens

They used an external library that used AWS IP pools to rotate IPs for scraping and brute force attacks. They downloaded external GitHub tools like requests-ip-rotator and browserless — neither of which the agency uses.

The most daming claim in this statement IMO: Within 15 minutes of DOGE accounts being created… Attackers in Russia tried logging in using those new creds. Correct usernames and passwords. 2 options here. The DOGE device was hacked. And I don't think I need to explain the 2nd.

Multi-factor authentication? Disabled. Someone downgraded Azure conditional access rules — MFA was off for mobile. This was not approved and not logged.

Jesus christ, flooding the zone with shit is still an unstoppable force: I'd say that THIS point deserves a week full of banner headlines but you still have Trump deporting citizens and legal immigrants.

DOGE cavalier conduct with our countries most sensitive information is a national security threat.Remember when Trump fought tooth and nail to not have his tax info released?Now his minions are accessing everyone's data.The prospect of weaponized leaks is real.The prospect of obstruction as well. ✌️

People don't just put in the correct credentials to an account 15 minutes after it's created unless the account was set up on their behalf. If they had already compromised the system or devices they wouldn't use the new accounts with eyes on them - theyd' set up their own. Those were for them.

Agree with analysis. Am experiences: lot of emails Many calls. Notifications fm bank & credit cards attempted charges not made b4 a 1 time Codes not requested. Steps can B made to intervene. Social security is locked & my PPO medicare needs verification. But how long? Plan Rob than Collapse

Will share. It’s obvious to anyone who can see that Russia is allegedly pulling the strings guiding the dismantling of American institutions, infrastructures of prosperity and innovation, alienating its allies, creating an authoritarian regime, and decimating its prosperity.

Elon & team of hackers removed all security from the computers...they left all the "doors" open & turned off all the "alarms". Then tried to hide their own "footprints". Then Elon & team of hackers left the computers like that...to be hacked by Russians which occurred right away. Suspicious enough?

All of this is what I've been yelling to the void. The firings and chaos are cover for a massive security breach of the worst kind, from the inside with physical access. There has not been a day I trusted starlink. You know he scrapes the data.

Remember several years ago when Steve Bannon declared his admiration for Lenin because he managed to destroy the Russian stare in 1917. Bannon said his hope was to see the destruction of the administrative state in the US.