The U.S. Department of the Treasury disclosed on Monday that a sophisticated cyberattack, attributed to a Chinese state-sponsored Advanced Persistent Threat (APT) group, had breached its systems, accessing an undisclosed number of workstations and stealing certain unclassified documents. The breach has been classified as a “major cybersecurity incident.”

How the Attack Unfolded
The breach was discovered on December 8 when cybersecurity provider BeyondTrust alerted the Treasury Department about unauthorized access to a key securing remote technical support for Treasury workstations. This incident is part of a worrying trend of state-sponsored cyberattacks targeting U.S. government agencies, including previous assaults involving Microsoft 365 and the infamous SolarWinds incident.

Incident Response and Ongoing Investigations
The Treasury Department has taken the affected service offline and is working with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, intelligence agencies, and third-party forensic experts to assess the breach and its impact. Treasury has assured stakeholders that additional details will be shared in a supplemental report within 30 days.

BeyondTrust, the provider of the compromised service, identified the issue during an internal investigation on December 2. By December 5, the company confirmed anomalous behavior impacting a “limited” number of its Remote Support SaaS instances and immediately revoked the compromised key.

BeyondTrust has patched two identified vulnerabilities—one of critical severity and the other medium—in its Remote Support and Privileged Remote Access products. Patches for both cloud-based and on-premises deployments have been released, ensuring enhanced security for customers.

Cybersecurity experts are closely monitoring the situation to understand the attackers’ objectives.

A Persistent Threat to U.S. Government Security
This latest breach underscores the persistent vulnerabilities in supply chain security and highlights the sophistication of state-sponsored cyberattacks. With China’s hacking groups often targeting U.S. government agencies, bolstering cybersecurity defenses remains a critical priority.

As the investigation unfolds, the breach serves as a stark reminder of the ongoing cybersecurity challenges faced by U.S. agencies. Continuous vigilance, proactive patching, and collaboration between private and public sectors are essential to mitigating such threats in the future.

The cybersecurity community awaits Treasury’s supplemental report for further insights into the scope and implications of this major incident.