US Treasury Department Breached via Vulnerabilities in Be...

A disclosure notice to Congress revealed that the US Treasury Department was compromised when hackers exploited vulnerabilities in BeyondTrust's remote tech support software. BeyondTrust notified the Treasury of the incident on December 8 after attackers stole an authentication key, bypassing system defenses and gaining access to Treasury workstations. The compromised BeyondTrust service has since been taken offline. At this time, there is no evidence indicating the threat actor has continued access to Treasury information. The Treasury has been collaborating with the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the intelligence community, and private forensic investigators to evaluate the situation.

Read more at source.

Details of the Breach

The BeyondTrust alert identified two exploited vulnerabilities: the critical command injection vulnerability 'CVE-2024-12356' and the medium-severity command injection vulnerability 'CVE-2024-12686'. Command injection vulnerabilities are common application flaws that can be easily exploited to gain access to a target's systems. Despite being common, their presence in a secure remote access product intended for government use has raised eyebrows.

Implications for FedRAMP-certified Cloud Infrastructure

BeyondTrust is a Federal Risk and Authorization Management Program (FedRAMP) vendor. There's speculation that the Treasury may have been using a non-FedRAMP version of BeyondTrust's products. If the breach affected FedRAMP-certified cloud infrastructure, it might be the first breach of one and almost certainly the first time FedRAMP cloud tools were abused to facilitate remote access to a customer's systems.

Context: The Salt Typhoon Espionage Campaign

This breach comes amid US officials' scramble to address a massive espionage campaign compromising US telecoms, attributed to the China-backed hacking group known as Salt Typhoon. White House officials reported that Salt Typhoon breached nine US telecoms.