US Treasury Accuses China of Hacking Its Workstations

Facts

• The US Dept. of the Treasury alleged on Monday that Chinese state-sponsored hackers gained unauthorized access to employee workstations and unclassified documents earlier this month through a compromised third-party software service provider called BeyondTrust.^[1][2]
• BeyondTrust first detected suspicious activity on Dec. 2, confirmed the breach on Dec. 5, and notified the Treasury Department on Dec. 8 that hackers had obtained a security key that allowed remote access to Treasury systems.^[3]
• The Treasury Department designated this breach a "major cybersecurity incident" and is working with the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and intelligence agencies to investigate its full scope and impact.^[1][4]
• The compromised BeyondTrust service has been taken offline, and officials state there is no evidence of continued unauthorized access to Treasury systems or information.^[3]
• This incident follows accusations of Salt Typhoon, the alleged Chinese cyberespionage campaign that affected nine telecommunications companies and potentially accessed phone records across American society.^[2][5]
• The Treasury Department monitors global financial systems and economies and has previously levied sanctions against China, making it a potential target for intelligence-gathering operations. The hackers are believed to be spying rather than stealing money or compromising essential infrastructure.^[2][4]

Sources: ^[1]Reuters, ^[2]BBC News, ^[3]CNN, ^[4]The New York Times and ^[5]NPR Online News.

Narratives

• Anti-China narrative, as provided by NPR Online News and The New York Times. The breach proves Chinese state-sponsored actors have deliberately targeted sensitive US government systems through sophisticated third-party compromise techniques. However, Washington will not tolerate efforts by the Chinese government to intimidate Americans who serve the public or steal from American institutions.
• Pro-China narrative, as provided by Global Times and Regtech Times. These accusations are baseless as China opposes all forms of hacking and cyber-attacks. The US must stop using cyber security to smear China's reputation or spread disinformation without evidence for political purposes. Politicizing cybersecurity issues doesn't solve the real problem.