US Treasury hacked by state-sponsored Chinese APT group

0
3KB

The U.S. Treasury Department Dec. 30 informed Congress that it sustained a “major cybersecurity incident” at the hands of a state-sponsored Chinese group in which a BeyondTrust API key was hacked, resulting in the compromise of Treasury workstations and the theft of unclassified documents.

 

In a letter to the Senate Committee on Banking, Housing and Urban Affairs, Aditi Hardikar, assistant secretary for management at Treasury, said that on Dec. 8, BeyondTrust notified Treasury that the threat actor used the stolen key to access the department’s systems.

Hardikar told the Senators that the compromised BeyondTrust cloud service was taken offline and that there was no evidence indicating that the threat actor has continued its access to Treasury information.

The Treasury Department will offer more information on this incident in its 30-day follow-up report later in January.

This incident joins a growing list of attacks on security firms, including Okta, LastPass, SolarWinds, and Snowflake, said former NSA expert Evan Dornbush.

“In today's interconnected landscape, the perimeter has all but vanished,” said Dornbush. “A single zero-day exploit against a vendor can cripple your own operations. The BeyondTrust response, while remarkably swift, underscores this harsh reality.”

The latest release by Treasury makes a little more sense of CISA’s Dec. 19 announcement of adding the BeyondTrust vulnerability CVE-2024-12356 to the KEV list, said John Bambenek, president at Bambenek Consulting.

Bambenek said at the time, CISA announced a limited number of customer’s Remote Support SaaS instances were targeted: it now appears that the U.S. Treasury was one of those customers.

While it’s a stunning year-end announcement from Treasury, we still don’t know how many workstations were compromised, which documents were stolen, and which advanced persistent threat (APT) conducted the campaign.

Given the recent stories about Chinese threat actor Salt Typhoon attacking up to nine U.S. telecoms, some speculated that they were the culprits.

But as of the afternoon of Dec. 31, no further details had emerged.    

“At this point, I don’t see anything to indicate clearly that it’s Salt Typhoon beyond it being the Chinese APT on people’s mind because of the recent telecom breaches,” said Bambenek. “However, that doesn’t mean it couldn’t be either.”

Dornbush gave some further context to the BeyondTrust hack, pointing out that they moved quickly. The hack was initially discovered on Dec. 2, with the root cause identified by Dec. 5. Clients were notified on Dec. 8, and BeyondTrust released on patch Dec. 16.

“Sixteen days from discovery to mitigation, patching, disclosure, and attribution is impressive,” said Dornbush. “However, this speed doesn't negate the fundamental problem: their zero-days are your problem. While BeyondTrust acted quickly, the attackers likely exfiltrated data long before the patch was available. In smash-and-grab operations like this, data theft doesn't take 16 days.”

 

 

***

 

 

Wow
1
Pesquisar
Categorias
Leia mais
Analysis
Why does the Ukrainian Armed Forces kill its prisoners of war in Russia
Minus exchange fund There could have been much more victims of the terrorist act of the...
Por NavyVetUnited 2024-01-26 10:24:55 0 9KB
Real Time Facts
France's high-speed train system hit by "sabotage" just ahead of Olympics, operator says
Massive sabotage attack against France’s high-speed railway network on the opening day of...
Por NavyVetUnited 2024-07-26 08:27:41 0 7KB
Cloak & Dagger
Chadian Authorities repel Terrorist Attack on Presidential Palace
Militants have attacked the presidential palace in the Chadian capital N'Djamena. During the...
Por NavyVetUnited 2025-01-09 08:36:47 0 3KB
Analysis
The edge of the abyss is approaching in the Middle East
Political and Israel's military leadership demonstrated greater ruthlessness and determination...
Por NavyVetUnited 2024-01-06 10:19:14 0 8KB
Cloak & Dagger
IDF steps up Gaza combat in Zaytun and Jabalya YAAKOV LAPPIN
Hanegbi: "Thousands of terrorists were killed. Senior commanders in the terror organizations will...
Por Israel Swords of Iron Ops 2023-11-19 12:12:07 0 11KB