Chinese Cyber Attack Hits US Treasury: A Deep Dive Into The Breach

The US Treasury Department has alerted lawmakers about a significant cybersecurity breach, described by officials as a "major incident." According to a letter reviewed by CNN, the breach was orchestrated by a Chinese state-sponsored Advanced Persistent Threat (APT) actor, targeting Treasury workstations and unclassified documents.

How the Breach Was Discovered

The intrusion was first identified on December 8 when a third-party software provider, BeyondTrust, informed the Treasury Department that hackers had exploited a stolen key to gain remote access. "Based on available indicators, the incident has been attributed to a Chinese state-sponsored Advanced Persistent Threat actor," wrote Aditi Hardikar, Assistant Secretary for Management at the Treasury.

Immediate Response

A Treasury spokesperson confirmed the compromised service was promptly taken offline. Efforts are underway in collaboration with law enforcement and the Cybersecurity and Infrastructure Security Agency (CISA) to mitigate risks. Officials stated there is no evidence suggesting the hackers still have access to Treasury systems or data.

Details of the Attack

The hackers accessed a key used by BeyondTrust to secure its cloud-based service for technical support. This allowed them to bypass security protocols and infiltrate several Treasury workstations, accessing certain unclassified documents.

BeyondTrust reported the breach occurred on December 2, and by December 5, they confirmed unusual activity in their Remote Support product. The company swiftly suspended the affected systems, quarantined compromised instances, and engaged an external cybersecurity team for investigation. BeyondTrust emphasized that no other products were impacted and has been actively cooperating with law enforcement.

Next Steps and Ongoing Investigation

Treasury officials plan to brief House Financial Services Committee staff in a classified session next week, though an exact date is yet to be scheduled.

In the meantime, the Treasury Department is collaborating with the FBI, CISA, US intelligence agencies, and third-party forensic experts to fully assess the breach's scope and impact. "CISA was engaged immediately upon Treasury’s knowledge of the attack," Hardikar wrote, emphasizing the multi-agency effort to address the incident.

Major Cybersecurity Incident

According to Treasury protocols, incidents involving advanced persistent threat actors are classified as major cybersecurity breaches. A 30-day supplemental report is required to update on the situation.

While the full extent of the damage remains unclear, this breach underscores the ongoing risks posed by sophisticated cyberattacks and the importance of robust cybersecurity measures to protect sensitive government systems.