THIS IS BAD! More detailed analysis of DOGE espionage at NLRB

[Nevilledog]

Last edited Fri Apr 18, 2025, 12:55 PM - Edit history (1)

https://threadreaderapp.com/thread/1913023007263543565.html

🧵 THREAD: A federal whistleblower just dropped one of the most disturbing cybersecurity disclosures I’ve ever read.

He's saying DOGE came in, data went out, and Russians started attempting logins with new valid DOGE passwords

Media's coverage wasn't detailed enough so I dug into his testimony:



Who’s the whistleblower?

Daniel Berulis — a senior DevSecOps architect at the National Labor Relations Board (NLRB), formerly with TS/SCI clearance.

He just told Congress the Department of Government Efficiency (DOGE) pulled off a covert cyber op inside a federal agency.



DOGE demanded root access.

Not auditor access. Not admin.

They were given “tenant owner” privileges in Azure — full control over the NLRB’s cloud, above the CIO himself.

This is never supposed to happen.



They disabled the logs.

Berulis says DOGE demanded account creation with no recordkeeping.

They even ordered security controls bypassed and disabled tools like network watcher so their actions wouldn’t be logged.



And then the data started flowing out.

10+ GB spike in outbound traffic

Exfiltration from NxGen, the NLRB's legal case database

No corresponding inbound traffic

Unusual ephemeral containers and expired storage tokens



They used an external library that used AWS IP pools to rotate IPs for scraping and brute force attacks.

They downloaded external GitHub tools like requests-ip-rotator and browserless — neither of which the agency uses.



The most daming claim in this statement IMO:

Within 15 minutes of DOGE accounts being created…
Attackers in Russia tried logging in using those new creds.
Correct usernames and passwords.

2 options here. The DOGE device was hacked. And I don't think I need to explain the 2nd.



Multi-factor authentication? Disabled.

Someone downgraded Azure conditional access rules — MFA was off for mobile.

This was not approved and not logged.



Cost spikes without new resources.

Azure billing jumped 8% — likely from short-lived high-cost compute used for data extraction, then deleted.



Then came the intimidation.

While preparing this disclosure, Berulis found a drone surveillance photo of himself taped to his front door with a threatening note.

This was just a few days ago.



US-CERT was about to be called in.
CISA’s cyber response team.
But senior officials told them to stand down — no report, no investigation.



I'm going to cover this more as I find out more.

********

[alwaysinasnit]

1. JFC!!!!

[flamingdem]

2. Bookmarking

This one deserves attention. Smoking gun?

[Bread and Circuses]

3. Explosive!

We all suspected that Musk’s Hitler Youth Hackers were a front . Now we know!
Musk and #47 are giving backdoor access to the Russians for all our data.

[Bluethroughu]

4. Espinoage! Espinoage! Espinoage!

We have traitors committing espinoage against the United States and it's people.

This administration is attacking the country, its Constitution and its people.

[CitizenZero]

5. Espionage

These DOGE rats are guilty and are traitors. Musk is behind this and is probably collaborating with Russia. God help us regain control over our own government. When we do, these people are going to be facing deadly serious charges.

[littlemissmartypants]

6. Author...

Matt Johansen
@mattjay
Helping Secure the Internet | Long Island elder emo surviving in ATX | Expect: infosec current events, DFIR, appsec & cloudsec - and me!

Source:
https://threadreaderapp.com/user/mattjay

❤️pants
RESIST!!

[CitizenZero]

7. Furthermore

I am not very techie but I read the entire OP and was able to grasp it. It seems that the DOGE agents have a specific agenda and mission. And they apparently might be collaborating with Russian agents to accomplish this mission. Espionage. Possible Treason. This idea of government efficiency is perhaps a smokescreen for a possibly darker purpose- the destruction and takeover of the Federal Government, in collusion with Russia.

It is very good that we still have loyal Americans in these agencies like this whistleblower who can alert the public about these illegal DOGE operations that are apparently going on in the Federal Government. This is why Federal Workers should stay in government and fight for as long as they are able. If DOGE is doing this in this one agency, they are probably doing it in other agencies. We need loyalists inside the federal government to act as resistance and as agents in defense of the country.

My worst suspicion is that these DOGE operatives are directly working with Russian state agents. They could be being paid for these data exchanges with dark crypto money. This could be direct criminal collusion between DOGE, Musk, and Russia. This needs to be investigated swiftly and thoroughly, and the level of involvement of those in the Trump White House should be ultimately ascertained. This could be the greatest act of corruption and Treason in world history. These people need to be investigated and brought to justice.

[BadgerMom]

8. K & R for visibility.

Thank you, Nevilledog.

[Meowmee]

9. Is anyone doing anything about it?

[CitizenZero]

10. This Whole Thread

This whole thread should be reposted tomorrow in the day to get more visibility. I think that it is a smoking gun and it needs to be communicated to as many people as is possible.

[liberalla]

11. Thank you for posting this!

[moniss]

12. Excellent post and I would note that we need to keep in mind that

at any moment of the day there are hundreds of Russian operatives crawling around DC, NYC etc. They would, like everybody else, be aware that Edolph and his bunch are crawling through system after system and there is no doubt they would try to infiltrate and as you pointed out there is of course the 2nd option.

[Hornedfrog2000]

13. Musk had meetings with putin too

Its not all by coincidence. It is obvious this is a coordinated cyberwarfare campaign, and we have been at war for a good 10 years now. The media chooses to ignore this. They could easily shut our infrastructure down as well. When hawaii had the nuke alarms go off, the sirens that all went off in houston, etc. Etc. They were showing they can hack our systems.

[Nevilledog]

14. Morning kick

[BoRaGard]

15. the republicon-russian attack on America is

entering an even more degenerate phase...

[Nevilledog]

16. This is important kick

[Clouds Passing]

17. Important! Kick!

[CitizenZero]

18. Nevilledog

I hope that you don't mind, but I started another thread on the same topic because more people need to know about this. I
included a link to this thread in the new post. Here is a link to the new DU thread.--

https://www.democraticunderground.com/100220251068

[Nevilledog]

19. That's fine. I want people to see it.

[CitizenZero]

20. Cool

I do appreciate your original post. Thanks for bringing this to everyone's attention.