Chinese APT Exploits API Key to Access U.S. Treasury Systems
“On December 8, 2024, Treasury was notified by a third-party software service provider, BeyondTrust, that a threat actor had gained access to a key … to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users,” the department said in a letter informing the Senate Committee on Banking, Housing, and Urban Affairs.
“With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.”
The U.S. Treasury Department revealed it suffered a “major cybersecurity incident.” The incident took place in early December 2024 after the threat actors gained access to a Remote Support SaaS API key associated with BeyondTrust, which allowed them to reset passwords for local application accounts.
BeyondTrust has not disclosed how the key was obtained but said the API key has since been revoked and that impacted customers have been notified. The latest comes at a time when the U.S. is already battling cyber attacks from other Chinese hacking groups tracked as Volt Typhoon and Salt Typhoon, both of which have targeted critical infrastructure and telecom networks in the country. According to the Wall Street Journal, the telecom-related hacks are so “severe” that “the U.S. may never be able to say with certainty that the Chinese hackers have been fully rooted out.” Other targets of Salt Typhoon hacks included Charter Communications, Consolidated Communications, and Windstream.
“In the telecom attacks, the hackers exploited unpatched network devices from security vendor Fortinet and compromised large network routers from Cisco Systems,” the deep-dive report said. “In at least one case, they took control of a high-level network management account that wasn’t protected by multi-factor authentication, a basic safeguard.” China has denied any involvement in these attacks, even going to the extent of branding the Volt Typhoon as a disinformation campaign.
BLUF:
These attacks are evidence of more sophistication but have also taken advantage of complex systems that are subsequently compromised. The ability to mitigate these risks with defensive measures is clear and having multi layered defense in depth that can see both the network activity as well as find living off the land exploits is critical.
If you are a CIO, CISO and or responsible for cyber defense talk to us. This is in our swim lane and an area we defend on a regular basis. Critically the ability to know what is in place & what is not as well as to respond and recover need to be part of your plan including to be aware in low latency if there’s a compromise to your network and data.
Be safe out there!
