Report: Chinese Cyberattack Compromised CFIUS

A cyberespionage campaign attributed to Chinese hackers has reportedly compromised a U.S. government office critical to the evaluation of foreign investments for national security threats. This breach specifically targeted the Committee on Foreign Investment in the United States (CFIUS), which is overseen by the Department of the Treasury. The attackers’ ability to infiltrate such a pivotal office raises serious concerns regarding the security of sensitive governmental functions.

According to CNN, the hackers accessed CFIUS through vulnerabilities in the Treasury’s systems, which also extended their reach to the Office of Foreign Assets Control—a division tasked with enforcing sanctions. Acknowledgment of this breach by Treasury emphasizes the growing trend of sophisticated threats emanating from state-sponsored actors.

The group responsible for these attacks is identified as Silk Typhoon, which gained notoriety in 2021 for exploiting four zero-day vulnerabilities in Microsoft Exchange Server. This same group was previously linked to a series of cyber incidents that the United States and its allies condemned as irresponsible cyber behavior. Such tactics align with MITRE ATT&CK framework categories such as initial access and exploitation of vulnerabilities, suggesting a calculated approach by adversaries to infiltrate federal networks.

An investigation conducted by the Cybersecurity and Infrastructure Security Agency (CISA) indicated that the breach had not affected other federal agencies. The hackers gained entry to Treasury’s networks by leveraging cloud-based support services from a third-party contractor, BeyondTrust, which has since patched the vulnerabilities exploited in the attack.

In a swift response to the breach, the Biden administration imposed sanctions on Integrity Technology Group, a Beijing-based firm alleged to have links with the state-sponsored hacking group Flax Typhoon. This action illustrates the United States’ tightening measures against entities perceived as threats to national cybersecurity.

This breach comes amidst a broader pattern of aggressive cyber activities perpetrated by Chinese state-sponsored actors, targeting critical infrastructure and government networks. Analysts warn that such cyber operations may serve as a prelude to heightened geopolitical tensions, especially concerning issues like Taiwan. The implications of this breach extend beyond immediate cybersecurity concerns, signaling a need for increased vigilance among business owners in protecting their own systems against similar threats from foreign adversaries.