Chinese Hackers Accessed US Treasury Workstations

[Trevor Chandler]

Chinese Hackers Accessed US Treasury Workstations in ‘Major’ Cybersecurity Incident​

Chinese hackers remotely accessed US Treasury Department workstations and unclassified documents
after compromising a cloud-based service operated by BeyondTrust, the department said Monday.


Happy 2025 to BeyondTrust

 

[precious]

Eeeeh! What more do we know about the BeyondTrust compromise and how it all unfolded?

 

[Emmanuel Phakula Mandala]

The Chinese government has denied any involvement, calling the accusations baseless and The Treasury Department has taken the compromised service offline and is working with the FBI and other agencies to secure their systems.... its not safe out there and most of these attacks happen during holiday time like this when people are too relaxed ...

 

[Robina]

Chinese Hackers Accessed US Treasury Workstations in ‘Major’ Cybersecurity Incident​

Chinese hackers remotely accessed US Treasury Department workstations and unclassified documents
after compromising a cloud-based service operated by BeyondTrust, the department said Monday.


Happy 2025 to BeyondTrust

This breach underscores the critical importance of robust cybersecurity practices, especially when relying on third-party services. While it's concerning that attackers gained access to the U.S. Treasury's unclassified systems, it’s a wake-up call for both public and private sectors to reassess their supply chain vulnerabilities.

BeyondTrust’s involvement highlights how even trusted cybersecurity providers can be exploited, emphasizing the need for rigorous vetting and continuous monitoring of vendor services. The Treasury Department's swift response, including deactivating the compromised service and collaborating with federal agencies, is commendable, but it’s clear we need stronger preventative measures.

China’s denial is expected, but regardless of attribution, this incident shows how critical it is to invest in and prioritize cybersecurity at all levels.

 

[precious]

This breach underscores the critical importance of robust cybersecurity practices, especially when relying on third-party services. While it's concerning that attackers gained access to the U.S. Treasury's unclassified systems, it’s a wake-up call for both public and private sectors to reassess their supply chain vulnerabilities.

BeyondTrust’s involvement highlights how even trusted cybersecurity providers can be exploited, emphasizing the need for rigorous vetting and continuous monitoring of vendor services. The Treasury Department's swift response, including deactivating the compromised service and collaborating with federal agencies, is commendable, but it’s clear we need stronger preventative measures.

China’s denial is expected, but regardless of attribution, this incident shows how critical it is to invest in and prioritize cybersecurity at all levels.

Well said.........Prevention must be prioritized at all levels.

 

[Trevor Chandler]

This breach underscores the critical importance of robust cybersecurity practices, especially when relying on third-party services. While it's concerning that attackers gained access to the U.S. Treasury's unclassified systems, it’s a wake-up call for both public and private sectors to reassess their supply chain vulnerabilities.

BeyondTrust’s involvement highlights how even trusted cybersecurity providers can be exploited, emphasizing the need for rigorous vetting and continuous monitoring of vendor services. The Treasury Department's swift response, including deactivating the compromised service and collaborating with federal agencies, is commendable, but it’s clear we need stronger preventative measures.

China’s denial is expected, but regardless of attribution, this incident shows how critical it is to invest in and prioritize cybersecurity at all levels.

China may not deny, but they sure ain't gonna admit any involvement either!!!

Love your commentary!!!!

 

[Trevor Chandler]

The Chinese government has denied any involvement, calling the accusations baseless and The Treasury Department has taken the compromised service offline and is working with the FBI and other agencies to secure their systems.... its not safe out there and most of these attacks happen during holiday time like this when people are too relaxed ...

Too relaxed - like on Bourbon street in New Orleans :-(
It's unfortunate, but you almost just can never let your guard down!!!

That comment "It's not a matter of if, but when" applies to all levels of the public sector!
The U.S. Treasury? My goodness!!!!

 

[Rick Butler]

The Chinese government has denied any involvement, calling the accusations baseless

Of course they did.

Not even going to comment further - just going to say - trust another organization with your security and...well:

 

[precious]

Too relaxed - like on Bourbon street in New Orleans :-(
It's unfortunate, but you almost just can never let your guard down!!!

That comment "It's not a matter of if, but when" applies to all levels of the public sector!
The U.S. Treasury? My goodness!!!!

Even trusted providers aren’t immune......... A timely reminder to keep our defenses sharp and never stop reassessing risks, especially when third parties are involved!

 

[precious]

Of course they did.

Not even going to comment further - just going to say - trust another organization with your security and...well:

View attachment 2136

A wake-up call indeed.

 

[Rick Butler]

A wake-up call indeed.

Not really. If people are surprised by this, I would say, they're not really paying attention. It's not a question of if a breach will happen, but rather, when.

 

[precious]

Not really. If people are surprised by this, I would say, they're not really paying attention. It's not a question of if a breach will happen, but rather, when.

True! Your words are true straightforward here telling us cyberattacks are inevitable and we should just be prepared....

 

[Rick Butler]

This isn't just about preparation, though - because one can prepare to the Nth degree and still have a catastrophic breach.

So, what's the next step, mes amis? What's the answer when preparation is not enough?

 

[precious]

This isn't just about preparation, though - because one can prepare to the Nth degree and still have a catastrophic breach.

So, what's the next step, mes amis? What's the answer when preparation is not enough?

The next step isn't it building resilience?......Resilience-quick recovery and effective response when preparation is not enough

 

[Rick Butler]

The step that is missing here is what happens, following the breach and the subsequent cleanup of the mess. When a breach occurs, the cold hearted truth here, the part where I say the quiet part out loud, is that preparations failed as a result of People, Process, or Technology. Perhaps because the Risk Assessment wasn't done correctly (or at all). Perhaps there was a modicum of incompetence in the practitioners or in the organizational leadership complaining of a strained budget, thus, skimping on resources. Whatever the cause, the problem here is that someone screwed up.

The after action review needs to immediately follow that needs to show what went wrong, with the accountability necessary to remove the people, processes and technology that failed, followed immediately by the corrective actions to all three of these.

I maintain that the feel-good-ism, don't-offend-people, that permeates the workplace these days has no place in the security department. Emotional feelings and "understanding" often hide the real problem - someone at BeyondTrust and/or the Treasury royally screwed up and needs to pay the price. Unfortunately, we will probably never know, if at all, what the outcome of this was.

Very rarely does a zero-day occur that is so completely unconventional that it takes people by surprise. This is why I have zero sympathy here - because the government trusted an organization that turned out to be incompetent and/or not vigilant enough to see what was coming.

/r

 

[precious]

The step that is missing here is what happens, following the breach and the subsequent cleanup of the mess. When a breach occurs, the cold hearted truth here, the part where I say the quiet part out loud, is that preparations failed as a result of People, Process, or Technology. Perhaps because the Risk Assessment wasn't done correctly (or at all). Perhaps there was a modicum of incompetence in the practitioners or in the organizational leadership complaining of a strained budget, thus, skimping on resources. Whatever the cause, the problem here is that someone screwed up.

The after action review needs to immediately follow that needs to show what went wrong, with the accountability necessary to remove the people, processes and technology that failed, followed immediately by the corrective actions to all three of these.

I maintain that the feel-good-ism, don't-offend-people, that permeates the workplace these days has no place in the security department. Emotional feelings and "understanding" often hide the real problem - someone at BeyondTrust and/or the Treasury royally screwed up and needs to pay the price. Unfortunately, we will probably never know, if at all, what the outcome of this was.

Very rarely does a zero-day occur that is so completely unconventional that it takes people by surprise. This is why I have zero sympathy here - because the government trusted an organization that turned out to be incompetent and/or not vigilant enough to see what was coming.

/r

Your perspective highlights an important truth: when breaches occur, they often expose weaknesses in people, processes, or technology...... In this case, the bigger implication-that trust was placed in an institution that failed to live up to expectations-is more concerning than the breach itself. Beyond the technical issues, that failure erodes trust in systems, collaborations, and supervision. After a breach, there is an opportunity to restore not only systems but also trust, which calls for openness, responsibility, and the guts to take immediate action.

 

[Rick Butler]

... which calls for openness, responsibility, and the guts to take immediate action.

That's where it disappears. There will always be failures in people, process, and technology - that's just inherent to the human experience. Unfortunately, the real issue has to do with the follow up. If I were involved in that kind of screw up and I was found to be culpable, I would expect to be fired or having to write a resignation letter, walking out of the building in disgrace and shame. I would expect zero tolerance because when it comes to systems of trust, the price of failure can deeply damage institutions on which people depend; it can even cost lives.

Sadly, we live in a society these days that is more bent on the preservation of face and feelings, an over-indulgence of emotionalism, rather than facts and the ramifications about facts, protecting those with money, power, and influence, rather than actually dealing with security in a matter-of-fact'ly kind of way.

I get annoyed when something like this happens and decision-makers stand around, trying to figure out "how to make it all go away", as if professional forgiveness will make it all better. It's far too important in the real world.