Role
Third-party risk
See what is exposed about your suppliers from the outside, without waiting for a questionnaire, and raise it with evidence.
Read more
Significant cyber incident
US Treasury breach through BeyondTrust
In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury, and the case became public in early January 2025.
In short
In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury, and the case became public in early January 2025. CISA said it was working with Treasury and BeyondTrust, the maker of remote support software, and saw no sign that other federal agencies were hit. Treasury sanctioned Yin Kecheng, whom it linked to the compromise, and the Justice Department unsealed charges against him in March 2025.
What happened
In late 2024 an intruder got into the Departmental Offices network of the US Department of the Treasury. CISA described it on 6 January 2025 as a cybersecurity incident from the week before and said it was working with Treasury and BeyondTrust.
At that time CISA saw no sign that other federal agencies were affected. On 17 January 2025 Treasury sanctioned Yin Kecheng, whom it linked to the compromise. On 5 March 2025 the Justice Department said court documents allege he took part in the hack between about September and December 2024.
Two BeyondTrust remote support flaws were added to the CISA Known Exploited Vulnerabilities catalog, on 19 December 2024 and 13 January 2025. The sources we opened do not say which flaw, if any, was used against Treasury.
Timeline
-
August 2013
The Justice Department says the charged activity of Yin and co-conspirators starts here and runs to December 2024.
-
Approximately September 2024
Per Justice Department seizure documents, the alleged Treasury intrusion by Yin begins.
-
19 December 2024
CISA adds BeyondTrust flaw CVE-2024-12356 to the Known Exploited Vulnerabilities catalog, due date 27 December 2024.
-
Approximately December 2024
Per Justice Department seizure documents, the alleged Treasury intrusion ends.
-
6 January 2025
CISA says it is working with Treasury and BeyondTrust and sees no sign other federal agencies are affected.
-
13 January 2025
CISA adds BeyondTrust flaw CVE-2024-12686 to the catalog, due date 3 February 2025.
-
17 January 2025
Treasury sanctions Yin Kecheng, a cyber actor it says was associated with the compromise of the Treasury Departmental Offices network.
-
5 March 2025
Justice Department unseals indictments against Yin Kecheng and Zhou Shuai and announces domain and server seizures.
-
5 March 2025
Treasury sanctions Zhou Shuai; State Department announces reward offers of up to 2 million dollars each.
How the attack worked
What the public sources say
The Justice Department says court documents allege Yin and his co-conspirators exploited vulnerabilities in victim networks, did reconnaissance inside them, and installed malware such as PlugX for persistent access. It then says they stole data and sent it to servers they controlled. This describes their wider campaigns, not only Treasury.
For the Treasury case, seizure warrant documents allege that the virtual private servers used in the intrusion were controlled by an account Yin and his co-conspirators set up.
The BeyondTrust flaws
CVE-2024-12356 is a command injection flaw in BeyondTrust Privileged Remote Access and Remote Support. An attacker without a login could run commands as a site user. CVE-2024-12686 is an operating system command injection flaw. An attacker who already has administrative privileges can upload a malicious file and run commands as the site user. CISA added both to its exploited list.
What we cannot say
The government pages we opened do not state the exact entry route into Treasury. They do not say which BeyondTrust flaw, if any, was used. No ATT&CK techniques are listed because no opened source maps this case to them.
Who says who was behind it
Attributed by the US Department of the Treasury (OFAC), 17 January 2025: Yin Kecheng, a cyber actor affiliated with the Chinese Ministry of State Security, was associated with the compromise of the Treasury Departmental Offices network.
Attributed by the US Department of Justice, 5 March 2025: court documents allege Yin Kecheng, described as an APT27 actor, took part in the Treasury hack between about September and December 2024. APT27 is also known as Threat Group 3390 to private researchers, per the same release.
Treasury, 5 March 2025, repeats that Yin was involved in the 2024 compromise of the Treasury network. These are allegations in an indictment and seizure documents, not court findings.
Impact
CISA said on 6 January 2025 that there was no indication that any other federal agencies had been impacted.
The Treasury network affected was named as the Departmental Offices network.
The pages we opened do not state what data was accessed, how many records or people were affected, or any financial loss from the Treasury incident.
The Justice Department states in general that Yin and Zhou's hacking across many US victims left millions of dollars in damages. This is not a Treasury figure.
Government and regulator response
- 19 December 2024: CISA added CVE-2024-12356 to its exploited list and told users to apply vendor mitigations or stop using the product.
- 6 January 2025: CISA said it was working closely with Treasury and BeyondTrust and would keep monitoring and give updates.
- 13 January 2025: CISA added CVE-2024-12686 with the same instruction.
- 17 January 2025: Treasury sanctioned Yin Kecheng under Executive Order 13694.
- 5 March 2025: The Justice Department unsealed indictments against Yin Kecheng and Zhou Shuai and announced seizures of domains and server accounts. Treasury sanctioned Zhou Shuai. The State Department announced reward offers of up to 2 million dollars each.
Lessons
-
Remote support tools are high value targets
CISA added two flaws in the same BeyondTrust remote support product to its exploited list within 25 days, which shows how often attackers aim at it.
-
Vendor incidents are your incidents
CISA worked with both Treasury and BeyondTrust. When a supplier is involved, your response depends on what the supplier tells you and how fast.
-
Patch dates are short for exploited flaws
CISA set a due date of 27 December 2024, eight days after listing CVE-2024-12356, for federal agencies.
-
Attackers need admin rights for one flaw only
CVE-2024-12686 needs existing administrative privileges, so protecting admin accounts limits that flaw. CVE-2024-12356 needed no login.
-
Attacker servers can be tracked
Justice Department documents say the servers used in the Treasury intrusion belonged to an account the attackers set up.
-
Public detail can be thin
The government pages do not say how the intruder reached Treasury. Plan for the cases where you must decide before the full story is known.
What to check in your own organization
-
Find every remote support tool
List all remote support and privileged access products in use, including cloud and on-site, and who owns each one.
-
Check BeyondTrust versions
If you use BeyondTrust Remote Support or Privileged Remote Access, confirm the vendor mitigations for CVE-2024-12356 and CVE-2024-12686 are applied.
-
Use the CISA exploited list
Match your software list against the CISA Known Exploited Vulnerabilities catalog and set short fix dates for matches.
-
Limit and review admin accounts
One of the flaws needs administrative privileges, so review who holds them on remote support platforms.
-
Review remote support logs
Look for unexpected sessions, file uploads and commands from remote support products around the exploitation windows.
-
Ask suppliers how they notify you
Confirm how and how fast each critical supplier tells you about an incident that touches your data.
-
Plan to retire what cannot be fixed
CISA's instruction was to apply mitigations or stop using the product. Decide in advance who can make that call.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
What happened at the US Treasury?
An intruder accessed the Departmental Offices network in late 2024. CISA described the incident on 6 January 2025 and said it was working with Treasury and BeyondTrust.
Was BeyondTrust involved?
CISA named BeyondTrust as a party it was working with. The pages we opened do not say how BeyondTrust products were used in the intrusion.
Which flaws did CISA list?
CVE-2024-12356 on 19 December 2024 and CVE-2024-12686 on 13 January 2025, both in BeyondTrust Privileged Remote Access and Remote Support.
Who is blamed?
Treasury linked Yin Kecheng, affiliated with the Chinese Ministry of State Security, to the compromise. The Justice Department charged him in an indictment unsealed 5 March 2025. These are allegations.
Were other agencies hit?
On 6 January 2025 CISA said there was no indication that other federal agencies were impacted.
What data was taken?
The pages we opened do not say.
In our research
- Remote support and file transfer flaws in ransomware attacks October 2026
- Government and public sector Industry
- Third-party risk Role
Sources
- CISA Update on Treasury Breach CISA
- CISA Adds One Known Exploited Vulnerability to Catalog CISA
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA
- Known Exploited Vulnerabilities Catalog, CVE-2024-12356 CISA
- Known Exploited Vulnerabilities Catalog, CVE-2024-12686 CISA
- Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise US Department of the Treasury
- Treasury Sanctions China-based Hacker Involved in the Compromise of Sensitive U.S. Victim Networks US Department of the Treasury
- Justice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion Campaigns US Department of Justice
- Cyber-related Designation (17 January 2025) OFAC, US Department of the Treasury
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.