Treasury officials admitted to lawmakers on Monday that state-sponsored Chinese hackers had breached computers and stolen documents in what they called a “major incident,” according to reports. Reuters.
Treasury officials said in a letter to lawmakers that the hackers “gained access to keys used by the organization.” [a third-party] The vendor secures cloud-based services used to remotely provide technical support to Department of Treasury (DO) end users. With access to the stolen keys, the attacker could disable the security of the service, remotely access the workstations of certain Treasury DO users, and gain access to certain non-confidential documents controlled by those users. is completed. ”
The vendor in question is Georgia-based BeyondTrustnotified Treasury officials of the breach on December 8. The letter further asserted that “based on available indicators, this incident is believed to be the work of a Chinese state-sponsored Advanced Persistent Threat (APT) actor.”
Incredibly, the Chinese government denied responsibility for the hack, saying, “China has always opposed all forms of hacker attacks.”
This is not the first time this year that a large-scale Chinese state-sponsored espionage/hacking operation has come to light. Earlier this year, the CCP-sponsored Salt Typhoon campaign successfully gained access to wireless networks such as Verizon and AT&T. The hack allowed the Chinese government to read the text messages of an unspecified number of Americans.
Disturbingly, although the breach was disclosed in October; The FBI announced earlier this month that He said Chinese hackers have not yet been removed from these networks, adding that it is “impossible to predict when they will be completely removed.”
The Treasury letter claims the affected services have been taken offline and hackers are no longer able to access Treasury documents. He also promised that an investigation was underway.
