I'm a cyber security incident responder. Firstly, let me claim my bias - I don't trust Kerbs after his FUD reporting about the CVE totally not losing funding. I started my cyber career in federal government contracting as a SOC Analyst and eventually became an incident responder.
My first doubt - the NLRB has a SOC ran by an MSSP/government contractor. Data destruction events and anomalous connections would 10000% cause security event alerts to trigger. Sentinel has OOB detection for anomalies for events that the whistle blower states in the article.
My Second doubt - CISA and US-CERT are not a bunch for scrubs. If their official statement is that it's not a security incident then I trust them.
Third doubt - If you see something suspicious then you have every right to report it to the SOC, and contain the suspicious activity to the best of your ability. If you don't have permissions then report it to the SOC. All malicious activity gets investigated (unless the MSSP is a joke but then they become liable and will get sued if it turns into an incident that results in damages).
Fourth doubt - Kerbs and the whistleblower are framing this as a sophisticated nation-state attack leveraging DOGE to exploit the NLRB. But that doesn’t add up. Nation-state actors don’t blow their cover because they proxy with clean IPs from within the target country. The IP address in question (83.149.30[.]186) has had a bad reputation in open-source intelligence for over a year, linked to credential stuffing and scanning activity. Using an IP like that in a high-level operation is like flying a spy plane into enemy airspace with inflatable tube men and disco balls strapped to the wings. Attacks of this complexity require significant time and resources—no serious actor would risk burning their investment by using an IP already flagged and based in Russia.
Last doubt - The "Security Engineer" took a screenshot of the user names then gave it to the media....You're expecting me to trust what you say while you commit a data leak - nice one.
818
452