China State-Sponsored Actor Infiltrates US Treasury Workstations

The Treasury Department is pictured in Washington

The US Treasury Department recently disclosed a significant cybersecurity incident involving a China state-sponsored actor infiltrating Treasury workstations. The breach was discovered when a third-party software service provider notified the Treasury on December 8 that a threat actor had gained unauthorized access using a stolen key to certain workstations and unclassified documents.

According to Treasury officials, the incident has been attributed to a Chinese state-sponsored Advanced Persistent Threat (APT) actor. The compromised service has since been taken offline, and the Treasury is collaborating with law enforcement and the Cybersecurity and Infrastructure Security Agency (CISA) to address the breach.

While there is no evidence of continued access to Treasury systems, officials are taking precautions. The Treasury plans to conduct a classified briefing with the House Financial Services Committee to provide more details about the breach.

The breach involved a third-party software service provider, BeyondTrust, whose Remote Support product was compromised. The threat actor used the stolen key to override the service's security, gaining access to Treasury workstations and certain documents.

Breach discovered through a third-party software provider alert on unauthorized access.

US Treasury Department disclosed a cybersecurity incident involving a China state-sponsored actor.

Chinese state-sponsored Advanced Persistent Threat (APT) actor attributed to the breach.

BeyondTrust confirmed the security incident on December 2 and has been working to investigate and mitigate the threat. The company has suspended and quarantined the impacted instances of the product and engaged external cybersecurity experts for support.

While the exact number of infiltrated workstations remains unclear, the Treasury has classified the incident as a major cybersecurity breach. The department is working closely with CISA, the FBI, US intelligence agencies, and third-party forensic investigators to assess the extent of the damage and determine the overall impact.

As per Treasury policy, incidents attributed to advanced persistent threat actors require a 30-day supplemental report to provide updates on the situation. The investigation is ongoing to fully characterize the breach and ensure the security of Treasury systems moving forward.