The attack affected several workstations within the Treasury, using third-party software, BeyondTrust, and was allegedly carried out, “according to available indications, by an actor financially supported by China”.
The American Department of the Treasury announced on Monday, in a letter addressed to elected representatives of the House of Representatives that AFP was able to consult, that it had been the victim of a cyberattack in early December but without risk for classified elements. According to the letter, the attack affected several workstations within the Treasury, using third-party software, BeyondTrust, and was allegedly carried out, “according to available indications, by an actor financially supported by China”.
“As soon as the service provider alerted Treasury, we contacted the Cybersecurity and Infrastructure Security Agency and worked with law enforcement to determine what the consequences of the intrusion werea ministry spokesperson said in a statement. The corrupted software has been removed and there is no evidence to suggest that the intruder was able to continue to have access to the Treasury's computer systems.”
Theft of a coded key
According to details provided by the Treasury in its letter to elected officials, the hackers managed to steal a coded key giving access to the software in question, which allowed them to bypass security systems and remotely access different computers. However, it is a “major IT security incident”recognizes the ministry, which obliges it to inform elected officials.
He plans to provide additional details within 30 days, as required by a 2014 Federal Government Systems Information Security Act. Attributing a cyberattack is very difficult to achieve technically, due to the many techniques used by hackers to cover their tracks, and politically sensitive.
However, this is not the first time that the United States, or some of its allies, have accused Beijing of being behind this type of action. Last March, Washington, London and Wellington accused China of being behind a series of attacks targeting their public institutions in recent years, an accusation rejected by Beijing, which deemed it “totally unfounded” and qualified as “calumny”.
