nightwing.com: Nightwing | Defining the Edge
krebsonsecurity.com - Cisa admin leaked aws govcloud keys on github

Nightwing (an intelligence services company spun off from Raytheon) specializes in high-stakes cyber operations and secure software development for government and national security agencies. Their services encompass offensive/defensive cyber operations, vulnerability research, and large-scale, mission-critical software modernization.
From the home page of Nightwing's web site:

"Built to protect our national security - no matter what"

"Nightwing is the national security solutions company that continually redefines the edge of possible. Our nation’s top agencies rely on us to outpace and outmaneuver the threat."

At the forefront
Always.

Nightwing delivers a comprehensive set of cutting-edge, technology-enabled capabilities to help our customers execute any mission. No matter what the challenge, we have what it takes to stay ahead of the adversary.

But ...

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.

On May 15, KrebsOnSecurity heard from Guillaume Valadon, a researcher with the security firm GitGuardian. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive.

A review of the GitHub account and its exposed passwords show the “Private CISA” repository was maintained by an employee of Nightwing, a government contractor based in Dulles, Va. Nightwing declined to comment, directing inquiries to CISA.

CISA has not responded to questions about the potential duration of the data exposure, but Caturegli said the Private CISA repository was created on November 13, 2025. The contractor’s GitHub account was created back in September 2018.

The GitHub account that included the Private CISA repo was taken offline shortly after both KrebsOnSecurity and Seralys notified CISA about the exposure. But Caturegli said the exposed AWS keys inexplicably continued to remain valid for another 48 hours.

Jeff