US Treasury Breached by China-Based Hackers in Cyberattack

The US Treasury Department confirmed a cyberattack by a China state-sponsored hacker group that gained access to some of its workstations and unclassified documents. This breach, attributed to an Advanced Persistent Threat (APT) actor, has raised concerns about the security of critical US government systems.

Incident Details

The breach occurred earlier this month when the hackers compromised a third-party cybersecurity provider, BeyondTrust. This allowed them remote access to Treasury workstations.

“The compromised BeyondTrust service has been taken offline, and there is no evidence indicating the threat actor has continued access to Treasury systems or information,” a Treasury spokesperson said.

The US Treasury, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and law enforcement, is investigating the full impact of the attack.

China State-Sponsored Threat Actor Involved

In a letter to the Senate Banking Committee, the Treasury identified the cyberattack as the work of a China state-sponsored APT actor. APT attacks are designed to establish unauthorized access and remain undetected for extended periods.

“Treasury takes very seriously all threats against our systems, and the data it holds,” the spokesperson added.

Historical Context of Chinese Cyber Threats

This breach is part of a series of alleged Chinese-government-backed cyberattacks targeting governments, businesses, and critical infrastructure globally.

• September 2023: The US Justice Department dismantled a cyberattack network affecting 200,000 devices, allegedly backed by China.
• February 2023: Authorities disrupted “Volt Typhoon,” a hacker group targeting public sector infrastructure like water treatment and transportation systems.
• 2023 Microsoft Breach: Hackers, identified as Storm-0558, breached email accounts of 25 US organizations, including the State Department and Commerce Secretary Gina Raimondo.

Beijing has consistently denied these allegations, asserting its opposition to all forms of cyberattacks.

Implications and Future Actions

The Treasury assured that it would continue to protect the US financial system and its data from threats. The department has pledged to release more details in a supplemental report.