CISA Investigates Chinese Hacking of Treasury Department

The U.S. cyber defense agency is aiding an investigation into a Beijing-linked hack of the Department of Treasury that officials said aimed to gather insights into future financial sanctions on Chinese companies.

See Also: Live Webinar | North Korea’s Secret IT Army and How to Combat It

The hack – described as an escalation of “the most prolific and far-reaching attack spree on U.S. critical infrastructure” – targeted the Office of Foreign Assets Control and other divisions tasked with sanctions enforcement. Treasury informed lawmakers it suspended cloud-based support services from third-party contractor BeyondTrust after detecting the breach in December (see: Chinese Hackers Breach US Treasury in ‘Major Incident’).

The Cybersecurity and Infrastructure Security Agency confirmed Monday in a statement sent to reporters that the agency “is working closely with the Treasury Department and BeyondTrust to understand and mitigate the impacts of the recent cybersecurity incident.”

The Treasury hacking comes amid a series of other high-profile Chinese attacks on U.S. critical infrastructure, telecommunications firms and federal networks, as experts warn Beijing is steadily preparing for future conflicts with Washington, including over a potential invasion of Taiwan. The Biden administration has ordered a wave of sanctions and takedowns targeting Chinese threat actors (see: US Sanctions Beijing Company for Flax Typhoon Hacking).

BeyondTrust said that an ongoing forensic investigation into the remote support SaaS incident “is approaching completion.”

All instances of its remote support flaws “have been fully patched” against the identified vulnerabilities and that an additional patch was pushed for self-hosted instances, Beyond Trust said. No other customers have been identified as affected by the hack, it said, an assertion seconded by CISA which told reporters that “there is no indication that any other federal agencies have been impacted by this incident.”

The Treasury previously told lawmakers it immediately engaged CISA after discovering Chinese-linked hackers breached its remote workstations via BeyondTrust’s cloud services. The cyber defense agency declined to comment publicly at the time, referring to Treasury Department updates on the hacking.

“The security of federal systems and the data they protect is of critical importance to our national security,” CISA added.