What Was Affected:<\/h2>\n\n\n\n
The hackers where able to get access to over 400 computers and over 3000 unclassified files. The hackers were targeting computers and files focused on the topics of sanctions and international affairs and intelligence [5]. This led to documents with information related to policy and travel, organizational charts, materials on sanctions and foreign investment, and \u2018Law Enforcement Sensitive\u2019 data all being accessed and leaked. The last one of \u2018Law Enforcement Sensitive\u2019 data is related to the Committee on Foreign Investment in the United States (CFIUS) which is a committee that investigates foreign investments in the United States for national security purposes like real estate purchases and other foreign investments in the states.<\/p>\n\n\n\n
Of potential greater concern among the affected computers are the Secretary of the US Treasury, Janet Yellen and other high-ranking officials. Just under 50 files were accessed on the Secretary’s computer including information like usernames, passwords, and the documents related to CFIUS.<\/p>\n\n\n\n
Overall, the report says no high-value information within the Treasury department was accessed and emails and classified networks were untouched[5]. In addition, no long-term reconnaissance tools were deployed within the network and no signs of malware have been detected.<\/p>\n\n\n\n
How did the Hack Happen:<\/h2>\n\n\n\n
The hackers used two CVE\u2019s to gain access to the US Treasury department one of critical severity and the other of medium severity.<\/p>\n\n\n\n
CVE-2024-12356 – A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user. [8]<\/p>\n\n\n\n CVE-2024-12686 – A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user. [9]<\/p>\n\n\n\n Theses vulnerabilities were present in BeyondTrust\u2019s SaaS application which the US Treasury used for cybersecurity. When BeyondTrust noticed suspicious activity on a computer and further investigated and discovered the vulnerability and hack they notified the US Treasury. Later on December 16, these vulnerabilities where patched on their cloud instances.<\/p>\n\n\n\n CVE-2024-12356 attacks flaws in BeyondTrust SaaS applications Privileged Remote Access and Remote Support features. Attacking a vulnerable API endpoint which allowed hackers to execute code on the site as the user giving them privilege access to the user\u2019s network. CVE-2024-12686 is then used once privilege access is gained to help keep persistence and run more commands.<\/p>\n\n\n\n Also known as HAFNIUM (G0125), Silk Typhoon are very likely a state-sponsored cyber group in China. They have over 26 TTP accredited to them on MITRE. Given this latest hack and hacks on the Telecom industry, the US has placed sanctions on Shanghai company Sichuan Juxinhe Network Technology CO. which is believed to have ties to Silk Typhoon. The sanctions specifically target hacker Yin Kecheng, both the company and Yin have ties to the China\u2019s Ministry of State Security. China\u2019s Foreign Minister spokesperson spoke out saying these claims that the attack was state sponsored are \u201cunwarranted and groundless\u201d.<\/p>\n\n\n\n For future security professional like us, this means we need to be aware that not all hacks and attacks on our systems are going to be from random hacking groups but can and likely will be from state sponsored groups sometimes. Though just because these hackers might be state-sponsored doesn\u2019t mean we can\u2019t do anything to prevent things like this from happening.<\/p>\n\n\n\n There are two things that the US Treasury could have done to help prevent this hack:<\/p>\n\n\n\n The first and main one is performing External Attack Surface Management (EASM). This is where the company looks at all outward facing endpoints and entry points into the company\u2019s network (mapping their attack surface) and catalogues it to understand what\u2019s viewable to the public. From there, the company needs to figure out which of these endpoints should be visible and why each endpoint is needed. If it’s not needed they need to get rid of it. After confirming the essential endpoints that are needed, known vulnerabilities should be scanned for and if any are found they should be patched. Having a EASM team and processes at a company helps the security team understand how they can be attacked and helps prevent future easily preventable attacks from happening.<\/p>\n\n\n\n The second thing the US Treasury could have done is better patch management and communicating to their service provider BeyondTrust the importance of this. Making sure that patches are rolled out regularly and quickly ensures known vulnerabilities get addressed as quickly as possible.<\/p>\n\n\n\n [1] https:\/\/www.csoonline.com\/article\/3632744\/chinesische-hacker-attackieren-us-finanzministerium.html<\/a><\/p>\n\n\n\n [2] https:\/\/www.reuters.com\/technology\/cybersecurity\/chinese-hackers-accessed-yellens-computer-us-treasury-breach-bloomberg-news-2025-01-17\/<\/a><\/p>\n\n\n\n [3] https:\/\/www.tomshardware.com\/tech-industry\/cyber-security\/chinese-hackers-infiltrated-us-treasury-secretarys-pc-attackers-had-access-to-over-400-pcs<\/a><\/p>\n\n\n\n [4] https:\/\/www.tomshardware.com\/tech-industry\/cyber-security\/chinese-hackers-target-us-treasury-computers-used-for-sanctions-committee-on-foreign-investment-specifically-targeted<\/a><\/p>\n\n\n\n [5] https:\/\/www.yahoo.com\/news\/treasury-hackers-focused-sanctions-intelligence-015705689.html<\/a><\/p>\n\n\n\n [6] https:\/\/www.reuters.com\/technology\/cybersecurity\/us-treasury-dept-issues-sanctions-related-salt-typhoon-hack-2025-01-17\/<\/a><\/p>\n\n\n\n [7] https:\/\/www.reuters.com\/technology\/cybersecurity\/us-treasury-dept-issues-sanctions-related-salt-typhoon-hack-2025-01-17\/<\/a><\/p>\n\n\n\n [8] https:\/\/www.cvedetails.com\/cve\/CVE-2024-12356\/<\/a><\/p>\n\n\n\n![\"\"](\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/01\/CVE-2024-123456-1024x160.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/01\/CVE-2024-123686-1-1024x146.png\")
<\/figure>\n\n\n\nWho is Silk Typhoon:<\/h2>\n\n\n\n
What this means for us:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/cdn.prod.website-files.com\/5ff66329429d880392f6cba2\/67850a0a9796ad81abd9d631_65fac05dc6d836748217c099_414-min.jpeg\")
<\/figure>\n\n\n\nReferences:<\/h2>\n\n\n\n