China hacks the US Treasury!

[NAME REMOVED]

US Treasury says Chinese hackers stole documents in 'major incident'

WASHINGTON, Dec 30 (Reuters) - Chinese state-sponsored hackers breached the U.S. Treasury Department's computer security guardrails this month and stole documents in what Treasury called a "major incident," according to a letter to lawmakers, opens new tab that Treasury officials provided to Reuters on Monday.

The hackers compromised third-party cybersecurity service provider BeyondTrust and were able to access unclassified documents, the letter said.

 

According to the letter, hackers "gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users."

 

"Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor," the letter said.

The Treasury Department said it was alerted to the breach by BeyondTrust on Dec. 8 and that it was working with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI to assess the hack's impact.

 

"China has always opposed all forms of hacker attacks," Mao Ning, a spokesperson for China's foreign ministry, told a regular news conference on Tuesday.

A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing "firmly opposes the U.S.'s smear attacks against China without any factual basis."

 

A spokesperson for BeyondTrust, based in Johns Creek, Georgia, told Reuters in an email that the company "previously identified and took measures to address a security incident in early December 2024" involving its remote support product. BeyondTrust "notified the limited number of customers who were involved," and law enforcement was notified, the spokesperson said. "BeyondTrust has been supporting the investigative efforts."

 

The spokesperson referred to a statement posted on the company's website, opens new tab on Dec. 8 sharing some details from the investigation, including that a digital key had been compromised in the incident and that an investigation was under way. That statement was last updated on Dec. 18.

 

Tom Hegel, a threat researcher at cybersecurity company SentinelOne (S.N), opens new tab, said the reported security incident "fits a well-documented pattern of operations by PRC-linked groups, with a particular focus on abusing trusted third-party services - a method that has become increasingly prominent in recent years," he said, using an acronym for the People's Republic of China."

 

source; https://www.reuters.com/technology/cybersecurity/us-treasurys-workstations-hacked-cyberattack-by-china-afp-reports-2024-12-30/

-----

 

The Chinese are at it again!

Edited December 31, 2024 by DUI_Offender

[ironstone]

The Biden/Harris administration will tolerate this, but Trump will not.

[WestCanMan]

It was the easiest hack of all time:

Username: Joe Biden

Password: 123uhhh...

[Deluge]

16 hours ago, DUI_Offender said:

US Treasury says Chinese hackers stole documents in 'major incident'

WASHINGTON, Dec 30 (Reuters) - Chinese state-sponsored hackers breached the U.S. Treasury Department's computer security guardrails this month and stole documents in what Treasury called a "major incident," according to a letter to lawmakers, opens new tab that Treasury officials provided to Reuters on Monday.

The hackers compromised third-party cybersecurity service provider BeyondTrust and were able to access unclassified documents, the letter said.

 

According to the letter, hackers "gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users."

 

"Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor," the letter said.

The Treasury Department said it was alerted to the breach by BeyondTrust on Dec. 8 and that it was working with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI to assess the hack's impact.

 

"China has always opposed all forms of hacker attacks," Mao Ning, a spokesperson for China's foreign ministry, told a regular news conference on Tuesday.

A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing "firmly opposes the U.S.'s smear attacks against China without any factual basis."

 

A spokesperson for BeyondTrust, based in Johns Creek, Georgia, told Reuters in an email that the company "previously identified and took measures to address a security incident in early December 2024" involving its remote support product. BeyondTrust "notified the limited number of customers who were involved," and law enforcement was notified, the spokesperson said. "BeyondTrust has been supporting the investigative efforts."

 

The spokesperson referred to a statement posted on the company's website, opens new tab on Dec. 8 sharing some details from the investigation, including that a digital key had been compromised in the incident and that an investigation was under way. That statement was last updated on Dec. 18.

 

Tom Hegel, a threat researcher at cybersecurity company SentinelOne (S.N), opens new tab, said the reported security incident "fits a well-documented pattern of operations by PRC-linked groups, with a particular focus on abusing trusted third-party services - a method that has become increasingly prominent in recent years," he said, using an acronym for the People's Republic of China."

 

source; https://www.reuters.com/technology/cybersecurity/us-treasurys-workstations-hacked-cyberattack-by-china-afp-reports-2024-12-30/

-----

 

The Chinese are at it again!

Only on the hair sniffer's watch....