US Treasury hacked by state-sponsored Chinese APT group

0
2K

The U.S. Treasury Department Dec. 30 informed Congress that it sustained a “major cybersecurity incident” at the hands of a state-sponsored Chinese group in which a BeyondTrust API key was hacked, resulting in the compromise of Treasury workstations and the theft of unclassified documents.

 

In a letter to the Senate Committee on Banking, Housing and Urban Affairs, Aditi Hardikar, assistant secretary for management at Treasury, said that on Dec. 8, BeyondTrust notified Treasury that the threat actor used the stolen key to access the department’s systems.

Hardikar told the Senators that the compromised BeyondTrust cloud service was taken offline and that there was no evidence indicating that the threat actor has continued its access to Treasury information.

The Treasury Department will offer more information on this incident in its 30-day follow-up report later in January.

This incident joins a growing list of attacks on security firms, including Okta, LastPass, SolarWinds, and Snowflake, said former NSA expert Evan Dornbush.

“In today's interconnected landscape, the perimeter has all but vanished,” said Dornbush. “A single zero-day exploit against a vendor can cripple your own operations. The BeyondTrust response, while remarkably swift, underscores this harsh reality.”

The latest release by Treasury makes a little more sense of CISA’s Dec. 19 announcement of adding the BeyondTrust vulnerability CVE-2024-12356 to the KEV list, said John Bambenek, president at Bambenek Consulting.

Bambenek said at the time, CISA announced a limited number of customer’s Remote Support SaaS instances were targeted: it now appears that the U.S. Treasury was one of those customers.

While it’s a stunning year-end announcement from Treasury, we still don’t know how many workstations were compromised, which documents were stolen, and which advanced persistent threat (APT) conducted the campaign.

Given the recent stories about Chinese threat actor Salt Typhoon attacking up to nine U.S. telecoms, some speculated that they were the culprits.

But as of the afternoon of Dec. 31, no further details had emerged.    

“At this point, I don’t see anything to indicate clearly that it’s Salt Typhoon beyond it being the Chinese APT on people’s mind because of the recent telecom breaches,” said Bambenek. “However, that doesn’t mean it couldn’t be either.”

Dornbush gave some further context to the BeyondTrust hack, pointing out that they moved quickly. The hack was initially discovered on Dec. 2, with the root cause identified by Dec. 5. Clients were notified on Dec. 8, and BeyondTrust released on patch Dec. 16.

“Sixteen days from discovery to mitigation, patching, disclosure, and attribution is impressive,” said Dornbush. “However, this speed doesn't negate the fundamental problem: their zero-days are your problem. While BeyondTrust acted quickly, the attackers likely exfiltrated data long before the patch was available. In smash-and-grab operations like this, data theft doesn't take 16 days.”

 

 

***

 

 

Wow
1
Search
Categories
Read More
Real Time Facts
Who is Syria’s de facto ruler Abu Mohammad al-Julani?
Al-Julani, A former member of al-Qaeda, the jihadist leader now presents a moderate image  ...
By NavyVetUnited 2024-12-09 11:28:10 0 2K
Real Time Facts
Kharkov incident reveals France's prolonged involvement in Ukraine conflict — expert
  The elimination of French mercenaries in Kharkov shows that France has long been...
By NavyVetUnited 2024-01-19 17:37:32 0 10K
Cloak & Dagger
2024 - IDF a Year in Review: Defining year in IDF history
A defining in year in the history of the IDF - IDF Spokesman LTC Nadav Shoshani   It's...
By Israel Swords of Iron Ops 2025-01-02 09:17:55 0 2K
Health
Hope for Cancer Patients: Researchers Unveil Innovative Dual-Drug Nanoparticle Therapy
Israeli and European researchers on Sunday unveiled a new approach to treating cancerous tumors...
By NavyVetUnited 2024-12-24 07:54:56 0 2K
Real Time Facts
How the Rockefellers Reshaped WHO to Serve Big Pharma  
The Rockefeller Foundation didn't just influence global health policy—it engineered the WHO...
By NavyVetUnited 2025-05-29 18:41:07 0 1K