Chinese hackers remotely accessed US Treasury Department workstations and unclassified documents after compromising a cloud-based service operated by BeyondTrust, the department said Monday.
While the Treasury described the situation as a “major cybersecurity incident,” the scope of the breach was not detailed, with no information on how many workstations had been compromised or what types of documents may have been accessed.
In a letter to lawmakers, Aditi Hardikar, Assistant Secretary for Management at the U.S. Department of the Treasury, said the Department learned of the problem from BeyondTrust on December 8th when the vendor said a threat actor had gained access to a key used by BeyondTrust to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users.
“With access to the stolen key, the threat actor was able override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users,” Hardikar continued.
Without providing any details, Hardikar said the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor.
“Treasury has been working with the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Intelligence Community, and third-party forensic investigators to fully characterize the incident and determine its overall impact. CISA was engaged immediately upon Treasury’s knowledge of the attack, and the remaining governing bodies were contacted as soon as the scope of the attack became evident.”
The compromised service has been taken offline, with no evidence indicating that the hackers still have access to department information, Hardikar said in the letter.
Earlier this month, BeyondTrust released patches for a critical-severity vulnerability (CVE-2024-12356) in its Privileged Remote Access (PRA) and Remote Support (RS) products that were exploited in the wild.
At the time, BeyondTrust shared that on December 5th, 2024, a root cause analysis into a Remote Support SaaS issue identified an API key for Remote Support SaaS had been compromised. The company said it immediately revoked the API key, notified known impacted customers, and suspended those instances the same day while providing alternative Remote Support SaaS instances for those customers.
News of the Treasury incident comes at a time where US officials are addressing the repercussions of a large-scale Chinese cyberespionage campaign, dubbed Salt Typhoon, which granted Beijing access to private text messages and phone conversations of an unspecified number of Americans. On Friday, a senior White House official said the number of telecommunications companies confirmed to be impacted by the attack campaign has now increased to nine.
Related: BeyondTrust Patches Critical Vulnerability Discovered During Security Incident Probe
Related: CISA, FBI Confirm China Hacked Telecoms Providers for Spying
