enderst

semper fi

[Team Cymru Research @teamcymru_S2]

INTEL DROP

We've been tracking suspicious open directories in our detection pipeline.

14 total IPs in the 149.50.98.0/24 (MEVSPACE) range are showing a likely single operator deploying shared tools.
Possibly targeting SonicWall devices based on some of the names of directory files:
brute[.]py
hidden_payload.zip
server_obonz.jar
SonicDropper.exe
Sonic/
sonic_logs/
sonic_panel.py
sonic_panel_v3.py
sonic_panel_v5.py

IP List:
149.50.98.24
149.50.98.36
149.50.98.28
149.50.98.34
149.50.98.26
149.50.98.29
149.50.98.25
149.50.98.30
149.50.98.35
149.50.98.23
149.50.98.33
149.50.98.32
149.50.98.27
149.50.98.31

#threatintel #totalinsights

[enderst @enderst]

@Milajoy 0% you got weeks

[enderst @enderst]

@robertpatrickT2 ~Barstow

[enderst @enderst]

@AmericaPapaBear zig instead of zag

[enderst @enderst]

@MbarkCherguia hmm would he have enjoyed the same exit if he didn't try to steal it? 🤔

[enderst @enderst]

@sarahadams @BullTheoryio @RonDeSantis Don't be fooled, they googled it

[enderst @enderst]

@ClownWorld heh the truck is at fault, the car could have avoided it.

[enderst @enderst]

@ClownWorld I thought Paddy dyed his hair.

[enderst @enderst]

VA launches MDMA-assisted mental health therapy trial https://t.co/elWTJc9KMq

[Sergeant Major Carlos A. Ruiz @USMCSgtMaj]

#MemorialDay. It’s one of the few holidays about absence.

For many of us, the empty seats are real.

So call your buddies today, but don’t let today be the only day. The empty seats around us deserve more than just one day of remembrance.

#NeverForgotten #HonorTheFallen

[enderst @enderst]

@Pallavi_345 Sadly, that was all there was to see.

[enderst @enderst]

@ThrillaRilla369 Aquanet

[enderst @enderst]

@Soapyshayna Well he dodged a bullet

[Sarah Adams @sarahadams]

@timburchett @SCLadyPatriot Actually I’d have to check but it actually was like $87 million

[enderst @enderst]

Cybersecurity Certificate Company Tier List 2026 https://t.co/CLW2sjaJWQ via @YouTube

[enderst @enderst]

Outdoor Boys Told Law Grads What No Professor Would https://t.co/keSdgfRZi7 via @YouTube

[enderst @enderst]

@Arkypatriot F2

[enderst @enderst]

@SGTWipper1Each Conform or find another club

[Linux Handbook @LinuxHandbook]

One of the biggest cybersecurity embarrassments of 2026 just happened.

Sensitive credentials linked to the US Cybersecurity agency (CISA) were reportedly found sitting inside a PUBLIC GitHub repository.

The exposed data allegedly included:
• SSH keys
• Plaintext passwords
• Internal system credentials
• Access linked to CISA and DHS environments

And the worst part?
Some of it may have been publicly accessible since November 2025.

According to reports, the leak came from a contractor-managed GitHub repo that was improperly secured. In simple words: someone accidentally left the digital keys to critical systems lying around on the internet.

What does this mean for users?

There’s currently no evidence that citizen data was stolen.

But incidents like this increase risks of phishing, impersonation attacks, and future breaches.

It also shows how even top cybersecurity organizations can fail basic security hygiene.

The agency responsible for protecting US infrastructure got caught exposing its own credentials online.

Cybersecurity isn’t just about advanced AI threats anymore. Sometimes it’s still just… human stupidity.