Post

🧵 THREAD: A federal whistleblower just dropped one of the most disturbing cybersecurity disclosures I’ve ever read. He's saying DOGE came in, data went out, and Russians started attempting logins with new valid DOGE passwords Media's coverage wasn't detailed enough so I dug into his testimony:

Who’s the whistleblower? Daniel Berulis — a senior DevSecOps architect at the National Labor Relations Board (NLRB), formerly with TS/SCI clearance. He just told Congress the Department of Government Efficiency (DOGE) pulled off a covert cyber op inside a federal agency.

DOGE demanded root access. Not auditor access. Not admin. They were given “tenant owner” privileges in Azure — full control over the NLRB’s cloud, above the CIO himself. This is never supposed to happen.

They disabled the logs. Berulis says DOGE demanded account creation with no recordkeeping. They even ordered security controls bypassed and disabled tools like network watcher so their actions wouldn’t be logged.

And then the data started flowing out. 10+ GB spike in outbound traffic Exfiltration from NxGen, the NLRB's legal case database No corresponding inbound traffic Unusual ephemeral containers and expired storage tokens

They used an external library that used AWS IP pools to rotate IPs for scraping and brute force attacks. They downloaded external GitHub tools like requests-ip-rotator and browserless — neither of which the agency uses.

The most daming claim in this statement IMO: Within 15 minutes of DOGE accounts being created… Attackers in Russia tried logging in using those new creds. Correct usernames and passwords. 2 options here. The DOGE device was hacked. And I don't think I need to explain the 2nd.

Multi-factor authentication? Disabled. Someone downgraded Azure conditional access rules — MFA was off for mobile. This was not approved and not logged.

Cost spikes without new resources. Azure billing jumped 8% — likely from short-lived high-cost compute used for data extraction, then deleted.

197 reposts1.5K likes

I scrolled through much of this information bc I don’t understand most of the terminology, but it sounds really , really bad! Congress should be all over this with shadow hearings by the Dems. Anything in that regard?

Then came the intimidation. While preparing this disclosure, Berulis found a drone surveillance photo of himself taped to his front door with a threatening note. This was just a few days ago.

adding original reporter to this thread. I didn't see this story before I wrote my summary. I saw it on NBC/CNN which was lighter on technical detail than I'd have liked so I went straight to the testimony Apologies Jenna if this came off dismissive of her hard work bsky.app/profile/jenn...

Has anyone done any background on this whistleblower? Spoken to his colleagues and family? It’s important to confirm that this guy isn’t insane, doesn’t have some sort of delusional disorder. We can’t afford to do a James Comer.

I think news organizations should be leading with the headline that someone was threatened with drone footage of themselves near their home. At this point most of us suspect Trump and Musk are involved with corrupt and traitorous dealings with Russia, but openly threatening people like this? Wow.

Wanna check this story that broke two days ago & see if you missed anything? bsky.app/profile/npr....

NPR@npr.org

EXCLUSIVE: A whistleblower tells Congress and NPR that DOGE may have taken sensitive labor data and hid its tracks. "None of that ... information should ever leave the agency," said a former NLRB official.

It really was. (It aired on Tuesday evening if op wants to look it up.) What got me was how clearly the dude WANTS to be wrong. He’s like, pls show me there’s another explanation, I’d be thrilled. He doesn’t want to be famous, just doesn’t want Russians all up in the NLRB’s shit. Actual patriotism.

Law enforcement authorities can’t do shit. They don’t have access to such surveillance info. You need other government agencies for that. And those guys are the ones who collected the drone surveillance and note in this first place. Sloppy work (like this) means they want to be found out. No doubt.