DOGE worker's old creds found exposed in infostealer malware dumps
(2025/05/12)
- Reference: 1747024211
- News link: https://www.theregister.co.uk/2025/05/12/doge_cyber_experts_creds_found/
- Source link:
Infosec in brief Good cybersecurity habits don't appear to qualify anyone to work at DOGE, as one Musk minion seemingly fell victim to infostealer malware.
Developer and journalist Micah Lee [1]reported last Thursday that he found a whopping 51 data breach records and four infostealer log dumps associated with DOGE employee [2]Kyle Schutt on data breach tracking service Have I Been Pwned (HIBP) – which is unnerving as Schutt has [3]access to sensitive government data at the Federal Emergency Management Agency.
As Lee pointed out, 51 breach records on HIBP is a lot, but excusable because while Schutt’s info was found in records associated with a 2013 Adobe breach, the 2016 LinkedIn breach, and Gravatar’s 2020 breach, none of those incidents involved Schutt’s personal machines.
[4]
What is attributable to a lapse of security hygiene, however, are the four infostealer logs that link to Schutt. Such logs contain usernames and passwords stolen by infostealer malware, suggesting one or more of Schutt's computers were compromised at some point.
[5]
[6]
According to Lee, account credentials linked to Schutt were found in the 100GB [7]Naz.API dump that contained 71 million unique email addresses and password combinations, the [8]ALIEN TXTBASE stealer dump containing 284 million unique accounts, an un-named July 2024 dump collated from malicious Telegram channels, and another massive stealer log added to HIBP in January 2025.
"I have no way of knowing exactly when Schutt's computer was hacked, or how many times," Lee pointed out, adding that evidence of infostealers means he fervently hopes DOGE staff are not using personal machines to access government records.
[9]
We asked Schutt for comment at his DOGE email address, which someone leaked online not long ago, but didn't hear back.
Critical vulnerabilities of the week: A Cisco perfect 10
Cisco patched a CVSS 10.0 vulnerability in the image download feature of Cisco IOS XE for WLCs last week. The flaw allows an unauthenticated remote attacker to upload arbitrary files to target systems, but only when particular settings are enabled.
The vulnerability, [10]CVE-2025-20188 is found in the out-of-band access point image download feature. If that’s not enabled, the CVE goes from 10.0 to zero. Can't install this patch now? Then just disable that feature until you can.
Elsewhere:
CVSS 9.8 - [11]CVE-2024-6047 : Several EoL GeoVision devices are vulnerable to OS command injection due to failing to filter user input. Check the link for affected models.
CVSS 9.8 - [12]CVE-2024-11120 : More EoL GeoVision command injection vulns, and these are under active exploit. Again, check the link for affected models. \
CVSS 9.8 - [13]CVE-2025-3248 : Langflow versions prior to 1.3.0 are vulnerable to code injection via crafted HTTP requests from remote unauthenticated users.
CVSS 8.8 - [14]CVE-2025-32819 : SonicWall SMA100 devices allow remote authenticated users with SSLVPN user privileges to delete files. One result of that deletion can be a reboot to factory default settings.
CVSS 8.3 - [15]CVE-2025-32820 : SonicWall SMA100 devices allow remote authenticated users with SSLVPN user privileges to inject path traversal sequences that make any directory on a targeted device writable.
CVSS 8.1 - [16]CVE-2025-27363 : FreeType versions 2.13.0 and below are vulnerable to an out of bounds write allowing arbitrary code execution. This is under active exploitation.
Director of hacked-to-death UK business warns eternal cyber vigilance essential
Paul Abbott wants everyone to know that cybersecurity never reaches a level at which you can relax. He ought to know - the 160-year old haulage firm he led went into administration in 2023 on his watch for that very reason.
[17]Per the BBC, Kettering-based business Knights of Old was hit by a ransomware attack two years ago that corrupted internal data so much that the company was unable to meet reporting deadlines set by its lenders. That left the firm, which [18]founded in 1865 with just a single horse and cart before growing into one of the largest privately owned logistics firms in the UK, with no option but to enter administration.
"We felt we were in a very good place in terms of our security, our protocols, the measures we'd gone to protect the business," Abbott told the BBC. He was wrong, and the company closed and let go of some 730 staff.
"Whatever you think you've done, seriously get it checked by experts," Abbott added. "People don't think it's going to happen to them."
LockBit pwned again
The LockBit ransomware gang is nothing if not persistent but appears unable to protect its own infrastructure as unknown attackers have apparently broken into the group and spilled a whole bunch of internal data online.
After [19]barely surviving an international takedown attempt, Russia-linked LockBit has soldiered on, but its online admin panel [20]disappeared last week – replaced by a message stating "Crime is bad" and link to a MySQL data dump full info about the ransomware crew’s operations.
[21]
In the dump were 59,975 unique bitcoin addresses, a table listing custom builds created by affiliates, configuration tables for those builds, a list of targets on which those builds were used, public keys (but no private ones), and chat records containing 4,442 negotiation discussions between LockBit operators and ransomware victims.
LockBitSupp, the crew’s suspected [22]boss , confirmed the breach in a discussion with the threat actor who first reported the matter on X.
Celsius ponzi kingpin jailed for a dozen years
Following his guilty plea in December 2024, the CEO of collapsed crypto firm Celsius has been [23]sentenced to 12 years in prison, ordered to pay a $50k fine, and forced to forfeit more than $48 million in misappropriated funds.
Alex Mashinsky was jailed for commodities fraud and securities fraud. The US Department of Justice described his activities as "a yearslong scheme to mislead customers" about Celsius' proprietary token, CEL, which he and other company leaders [24]manipulated .
Mashinsky made repeated false public statements about Celsius' market activity, the DoJ said, while he and other company leaders kept buying more CEL to pump its value while simultaneously selling it to others. ®
Get our [25]Tech Resources
[1] https://micahflee.com/doge-bro-kyle-schutts-computer-infected-by-malware-credentials-found-in-stealer-logs/
[2] https://projects.propublica.org/elon-musk-doge-tracker/#Kyle-Schutt
[3] https://www.dropsitenews.com/p/doge-fema-funding-access-social-security-numbers
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.troyhunt.com/inside-the-massive-naz-api-credential-stuffing-list/
[8] https://specopssoft.com/blog/alien-txtbase-data-dump-analysis/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC?
[11] https://www.cve.org/CVERecord?id=CVE-2024-6047
[12] https://www.cve.org/CVERecord?id=CVE-2024-11120
[13] https://www.cve.org/CVERecord?id=CVE-2025-3248
[14] https://nvd.nist.gov/vuln/detail/CVE-2025-32819
[15] https://nvd.nist.gov/vuln/detail/CVE-2025-32820
[16] https://www.cve.org/CVERecord?id=CVE-2025-27363
[17] https://www.bbc.com/news/articles/cpvren4je77o
[18] https://www.bbc.com/news/uk-england-northamptonshire-66927965
[19] https://www.theregister.com/2024/05/22/lockbit_dethroned_as_leading_ransomware/
[20] https://x.com/ReyXBF/status/1920220381681418713
[21] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[22] https://www.theregister.com/2024/05/07/alleged_lockbit_kingpin_charged_sanctioned/
[23] https://www.justice.gov/usao-sdny/pr/founder-celsius-sentenced-12-years-fraud-and-market-manipulation
[24] https://www.theregister.com/2023/02/01/celsius_bankruptcy_ponzi/
[25] https://whitepapers.theregister.com/
Developer and journalist Micah Lee [1]reported last Thursday that he found a whopping 51 data breach records and four infostealer log dumps associated with DOGE employee [2]Kyle Schutt on data breach tracking service Have I Been Pwned (HIBP) – which is unnerving as Schutt has [3]access to sensitive government data at the Federal Emergency Management Agency.
As Lee pointed out, 51 breach records on HIBP is a lot, but excusable because while Schutt’s info was found in records associated with a 2013 Adobe breach, the 2016 LinkedIn breach, and Gravatar’s 2020 breach, none of those incidents involved Schutt’s personal machines.
[4]
What is attributable to a lapse of security hygiene, however, are the four infostealer logs that link to Schutt. Such logs contain usernames and passwords stolen by infostealer malware, suggesting one or more of Schutt's computers were compromised at some point.
[5]
[6]
According to Lee, account credentials linked to Schutt were found in the 100GB [7]Naz.API dump that contained 71 million unique email addresses and password combinations, the [8]ALIEN TXTBASE stealer dump containing 284 million unique accounts, an un-named July 2024 dump collated from malicious Telegram channels, and another massive stealer log added to HIBP in January 2025.
"I have no way of knowing exactly when Schutt's computer was hacked, or how many times," Lee pointed out, adding that evidence of infostealers means he fervently hopes DOGE staff are not using personal machines to access government records.
[9]
We asked Schutt for comment at his DOGE email address, which someone leaked online not long ago, but didn't hear back.
Critical vulnerabilities of the week: A Cisco perfect 10
Cisco patched a CVSS 10.0 vulnerability in the image download feature of Cisco IOS XE for WLCs last week. The flaw allows an unauthenticated remote attacker to upload arbitrary files to target systems, but only when particular settings are enabled.
The vulnerability, [10]CVE-2025-20188 is found in the out-of-band access point image download feature. If that’s not enabled, the CVE goes from 10.0 to zero. Can't install this patch now? Then just disable that feature until you can.
Elsewhere:
CVSS 9.8 - [11]CVE-2024-6047 : Several EoL GeoVision devices are vulnerable to OS command injection due to failing to filter user input. Check the link for affected models.
CVSS 9.8 - [12]CVE-2024-11120 : More EoL GeoVision command injection vulns, and these are under active exploit. Again, check the link for affected models. \
CVSS 9.8 - [13]CVE-2025-3248 : Langflow versions prior to 1.3.0 are vulnerable to code injection via crafted HTTP requests from remote unauthenticated users.
CVSS 8.8 - [14]CVE-2025-32819 : SonicWall SMA100 devices allow remote authenticated users with SSLVPN user privileges to delete files. One result of that deletion can be a reboot to factory default settings.
CVSS 8.3 - [15]CVE-2025-32820 : SonicWall SMA100 devices allow remote authenticated users with SSLVPN user privileges to inject path traversal sequences that make any directory on a targeted device writable.
CVSS 8.1 - [16]CVE-2025-27363 : FreeType versions 2.13.0 and below are vulnerable to an out of bounds write allowing arbitrary code execution. This is under active exploitation.
Director of hacked-to-death UK business warns eternal cyber vigilance essential
Paul Abbott wants everyone to know that cybersecurity never reaches a level at which you can relax. He ought to know - the 160-year old haulage firm he led went into administration in 2023 on his watch for that very reason.
[17]Per the BBC, Kettering-based business Knights of Old was hit by a ransomware attack two years ago that corrupted internal data so much that the company was unable to meet reporting deadlines set by its lenders. That left the firm, which [18]founded in 1865 with just a single horse and cart before growing into one of the largest privately owned logistics firms in the UK, with no option but to enter administration.
"We felt we were in a very good place in terms of our security, our protocols, the measures we'd gone to protect the business," Abbott told the BBC. He was wrong, and the company closed and let go of some 730 staff.
"Whatever you think you've done, seriously get it checked by experts," Abbott added. "People don't think it's going to happen to them."
LockBit pwned again
The LockBit ransomware gang is nothing if not persistent but appears unable to protect its own infrastructure as unknown attackers have apparently broken into the group and spilled a whole bunch of internal data online.
After [19]barely surviving an international takedown attempt, Russia-linked LockBit has soldiered on, but its online admin panel [20]disappeared last week – replaced by a message stating "Crime is bad" and link to a MySQL data dump full info about the ransomware crew’s operations.
[21]
In the dump were 59,975 unique bitcoin addresses, a table listing custom builds created by affiliates, configuration tables for those builds, a list of targets on which those builds were used, public keys (but no private ones), and chat records containing 4,442 negotiation discussions between LockBit operators and ransomware victims.
LockBitSupp, the crew’s suspected [22]boss , confirmed the breach in a discussion with the threat actor who first reported the matter on X.
Celsius ponzi kingpin jailed for a dozen years
Following his guilty plea in December 2024, the CEO of collapsed crypto firm Celsius has been [23]sentenced to 12 years in prison, ordered to pay a $50k fine, and forced to forfeit more than $48 million in misappropriated funds.
Alex Mashinsky was jailed for commodities fraud and securities fraud. The US Department of Justice described his activities as "a yearslong scheme to mislead customers" about Celsius' proprietary token, CEL, which he and other company leaders [24]manipulated .
Mashinsky made repeated false public statements about Celsius' market activity, the DoJ said, while he and other company leaders kept buying more CEL to pump its value while simultaneously selling it to others. ®
Get our [25]Tech Resources
[1] https://micahflee.com/doge-bro-kyle-schutts-computer-infected-by-malware-credentials-found-in-stealer-logs/
[2] https://projects.propublica.org/elon-musk-doge-tracker/#Kyle-Schutt
[3] https://www.dropsitenews.com/p/doge-fema-funding-access-social-security-numbers
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.troyhunt.com/inside-the-massive-naz-api-credential-stuffing-list/
[8] https://specopssoft.com/blog/alien-txtbase-data-dump-analysis/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC?
[11] https://www.cve.org/CVERecord?id=CVE-2024-6047
[12] https://www.cve.org/CVERecord?id=CVE-2024-11120
[13] https://www.cve.org/CVERecord?id=CVE-2025-3248
[14] https://nvd.nist.gov/vuln/detail/CVE-2025-32819
[15] https://nvd.nist.gov/vuln/detail/CVE-2025-32820
[16] https://www.cve.org/CVERecord?id=CVE-2025-27363
[17] https://www.bbc.com/news/articles/cpvren4je77o
[18] https://www.bbc.com/news/uk-england-northamptonshire-66927965
[19] https://www.theregister.com/2024/05/22/lockbit_dethroned_as_leading_ransomware/
[20] https://x.com/ReyXBF/status/1920220381681418713
[21] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCHGvx3ezlDjyunEIgiZPQAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[22] https://www.theregister.com/2024/05/07/alleged_lockbit_kingpin_charged_sanctioned/
[23] https://www.justice.gov/usao-sdny/pr/founder-celsius-sentenced-12-years-fraud-and-market-manipulation
[24] https://www.theregister.com/2023/02/01/celsius_bankruptcy_ponzi/
[25] https://whitepapers.theregister.com/
Re: "Whatever you think you've done, seriously get it checked by experts"
JamesTGrant
Can’t remember who said it but;
Life is the worst teacher, it gives the exam before the lesson.
Just a side note
Anonymous Coward
None of the published sources are definite proof of poor security hygiene. Even the infostealer dumps mentioned are not proof of an infostealer infection. We use HIBP in our company and I have seen those too including attribution. They also contain credentials from previous breaches not harvested by an infostealer. Many of the dumps are simply remixes of previous ones and the credentials aren't valid anymore or never have been. It is also not clear how many of the breaches affected their user account or are breaches at data brokers that just contained public data scraped from LinkedIn etc.
Having said that 51 entries are still way more than I have ever seen or heard of.
There is more than one of everything.
Tron
Or there should be. If you can, your internal network should not touch the public internet. Have a second disposable and replaceable network that does. Air gap them with staff. Nothing else will give you adequate protection. Software is too complex and there will always be a way in. Yes, this rules out cloud storage and SaaS, but proper applications still exist and you can buy Tb of storage for peanuts now. Reorganise and simplify your tech, because if your internal systems are connected to the net, you are vulnerable.
And we could also shift to distributing personal data using permanent encrypted cookies on users' systems rather than having large data honeypots on commercial systems.
Evil Auditor
Good habits don't appear to qualify anyone to work at DOGE.
FTFY.
"Whatever you think you've done, seriously get it checked by experts"
There's nothing like a bad experience to get you focused on what you really need to pay attention to.
Unfortunately, sometimes it's too late to recover from the problem.