Loading story…
The U.S. Treasury Department disclosed a breach tied to a compromise of BeyondTrust remote support technology, with reports saying attackers used the third-party platform to gain access to Treasury systems in December. Coverage from BleepingComputer and SC Media said the intrusion affected the department through its remote support environment, raising concerns about supply-chain exposure and the security of privileged access tools used by federal agencies.
TechCrunch reported that the operation was attributed to Chinese government hackers and that one of the apparent targets was the Treasury office responsible for administering U.S. economic sanctions. If confirmed, the targeting would indicate an espionage-focused effort aimed at sensitive policy and enforcement information, adding to scrutiny of vendor-connected access paths into high-value government networks.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting on the Treasury breach said the attackers were Chinese government hackers and that they targeted offices including the sanctions unit during the December intrusion. The incident expanded concern because the sanctions office is central to U.S. economic enforcement policy.
During December 2024, attackers used a stolen BeyondTrust API key to remotely access U.S. Treasury Department user workstations and unclassified documents. Treasury described the intrusion as a major cybersecurity incident tied to a third-party service provider compromise.
Attackers breached BeyondTrust's remote support platform and obtained an API key used to access certain customer environments. BeyondTrust later identified the incident as affecting a limited number of customers, including the U.S. Treasury Department.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
techcrunch.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **pre-authentication remote code execution** flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as `CVE-2026-1731`, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while **CISA** added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub. Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including **financial services, technology, higher education, legal services, and healthcare**. Palo Alto Networks Unit 42 observed attackers deploying **SparkRAT** and **vShell** backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.
Jun 29, 2026
Suspected Chinese hackers were linked to multiple intrusions into Western government systems, including the exploitation of the **SolarWinds** software supply-chain compromise to access the U.S. National Finance Center, a payroll agency serving several federal departments, according to Reuters sources. In a separate case, Belgian prosecutors opened an investigation into an alleged breach of the country's intelligence service, with reports indicating Chinese state-linked actors may have accessed an external email server used for communications with public prosecutors, police, ministries, and other institutions. The incidents add to a broader pattern of state-backed cyber espionage focused on sensitive government data and communications infrastructure. The U.S. case highlighted how attackers used a trusted software update channel to reach federal networks, while the Belgian probe underscored concerns that third-party systems connected to intelligence and law-enforcement bodies can become high-value entry points for foreign surveillance operations.
Jul 12, 2026
U.S. health-sector authorities warned hospitals and clinics to urgently patch a **critical vulnerability** in *BeyondTrust Remote Support* and *Privileged Remote Access* that can provide attackers an initial foothold and enable **unauthorized control** of affected appliances inside enterprise networks. The flaw is tracked as **CVE-2026-1731** and was highlighted to the healthcare and public health sector amid increased targeting of those organizations. **CISA** added CVE-2026-1731 to its **Known Exploited Vulnerabilities (KEV)** catalog and set an accelerated remediation deadline for federal agencies, later updating the entry to warn that **ransomware operators are actively exploiting** the issue. *Palo Alto Networks Unit 42* also reported observed in-the-wild exploitation, describing threat actors weaponizing the vulnerability to take control of appliances and expand access within victim environments, increasing risk to clinical networks if unpatched.
Jul 12, 2026