U.S. Treasury says its computers were hacked by a Chinese 'threat actor' in a 'major incident'

[BumRushDaShow]

Source: NBC News

Dec. 30, 2024, 4:50 PM EST


he U.S. Treasury department said a state-sponsored Chinese hacking operation was able to use third-party software to access the desktop computers of Treasury employees in what the department is calling "a major incident."

In a letter seen by NBC News, Aditi Hardikar, assistant secretary for management of the U.S. Department of the Treasury, wrote that the office was notified on Dec. 8 of the breach. The letter is addressed to Sen. Sherrod Brown, D-Ohio, and Sen. Tim Scott, R-S.C., the chairman and ranking member, respectively, of the Committee on Banking, Housing and Urban Affairs.

Hardikar wrote that the U.S. Treasury was told by "a third-party software service provider, BeyondTrust, that a threat actor had gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users." With this access, the "threat actor" was able to override certain security measures and access the department office user workstations. The information accessed by the "threat actor" was unclassified documents.

The U.S. Treasury has been working with Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and other members of the intelligence community, as well as "third-party forensic investigators to fully characterize the incident and determine its overall impact," according to the letter.

Read more: https://www.nbcnews.com/tech/security/us-treasury-says-computers-hacked-chinese-threat-actor-rcna185809

[Irish_Dem]

1. How much damage was done?

What were the Chinese after, did they get it?

[erronis]

7. As dlk says below, "We'll never know"

Even if the US authorities (FBI, CISA, etc.) do uncover some of the traces of the infection, it will not be disclosed to the public.

1. You don't want your adversaries to know what you have uncovered;
2. The public has no right for full disclosures. (sarcasm)

[Irish_Dem]

8. We keep taking one major hacker hit after another.

And no one tells us how bad it is.

What do the Chinese want from the US Treasury?

[ananda]

10. LOL

[Irish_Dem]

12. It was a rhetorical question.

But how do they pull off the heist?
Don't they have to physically get the contents?

[ananda]

19. LOL again

Great rhetoric!

[SWBTATTReg]

2. Well, imho, I'm sure every valid entity in the US and the world is under some sort of cyber attack. Either by

foreign entities, or persons of ill-repute, trying to make a few bucks scamming the system somehow.

The world out there is NOT safe people. If you have an online presence, protect it at all costs. Avoid questionable sites. And perhaps use a separate ID to get into banking etc. sites vs. a media site, such as DU, facebook, etc.

[dlk]

3. We'll never know

The infiltration of Chinese hackers into America is much more pervasive than we will ever be told.

[Irish_Dem]

9. The Chinese are at war with the US and doing quite a bit of damage.

We are told over and over about the "major" attacks.

We know it is not good news.

[Evolve Dammit]

4. As Edward R. Murrow said: "Good night. And good luck." Truer words never spoken. We are needing some luck. BS crazy.

[SupportSanity]

5. BeyondTrust? This is the vendor who caused the problem. BeyondTrust. SMH n/t

[erronis]

13. No, this is the organization that detected the breach - as far as I can tell.

There is no mention of the vendor who had its software/hardware hacked but frequent candidates are network infrastructure, common "secure" software interconnections (FortiNet), and even software that is supposed to monitor for anomalies.

[pimpbot]

16. Wrong

Read the letter posted below in this thread. It explicitly says the Chinese compromised a beyondtrust service and used it to gain access.

[erronis]

17. Right you are. Thanks for correcting my mis-interpretation.

[usonian]

6. Report at DocumentCloud

https://www.documentcloud.org/documents/25472754-12/

One page only.



Pretty distinctive signature.
Hope Aditi's checkbook doesn't fall to the ground in the same parking lot I'm parked in.

[Joinfortmill]

11. This should not be happening. Someone or Someones are asleep at the switch here.

[erronis]

14. Lots of "switches" here. All the way from the target back through all the suppliers.

Each link on the chain can see intrusions (see SolarWinds). To get a product to run on a government system there may be 20-100 (swag) companies involved. The government has no way to audit all of the transactions or verify the final product.

A whole lot has been done in the last 5-10 years through efforts to secure the software and the chains. See CISA. However it's much harder to defend against attack than to be the attacker.

[drray23]

15. Well, after January 20th they won't need to hack to get in

They will just ask Elon.

[True Dough]

18. Recommended

It was a disheartening "rec," but a deserved one.

[DingleBerryNW]

20. They should've waited...

Until after the orange one’s inauguration. Trump would have just given the passwords. Saving the hackers countless hours of work….

[wolfie001]

23. I had an account when the interest rate was north of 9% and was loving it!

Of course it was very temporary, but I thought the whole on-line experience was a clunky, 1990s mess. It was a bit shocking really. This whole affair isn't surprising and with the fat orange asshole returning to the WH, things prolly won't get much better with protecting our nation's institutions. Thanks to the stupid half that voted for him or sat on their fucking hands.

[IcyPeas]

24. Are hackers using AI yet?

I dread hackers screwing with our power grid. That would be hell.