CISA Contractor (Nightwing) Exposed AWS GovCloud Admin Keys and Plaintext Credentials in Public GitHub Repo for Six Months

A CISA contractor at Nightwing maintained a public GitHub repository named 'Private-CISA' from November 13, 2025 to mid-May 2026 that contained 844MB of files including administrative credentials to three AWS GovCloud servers, plaintext usernames and passwords for dozens of internal CISA systems (including the LZ-DSO DevSecOps environment), access tokens for CISA's internal software artifactory, SSH keys, and internal build/deployment documentation. GitGuardian researcher Guillaume Valadon confirmed the credentials were live; security researcher Philippe Caturegli verified the AWS keys were still valid after the repo was taken down and warned that artifactory access could have enabled supply-chain backdoors in CISA's software builds. Congressional Democrats on the Homeland Security Committee have demanded a classified briefing, and CISA is investigating while stating no compromise has been confirmed — a 48-hour post-removal key validity window remains the most significant unresolved risk.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.