- The US Treasury has revealed that its Office of Foreign Investment was hit in the latest cyber attack
- The office reviews national security risks for investments
- Breach of a third-party vendor led to US Treasury systems being accessed
The US department, which reviews foreign investments for national security risks, has been revealed as a further victim of the cyber attack that targeted the US Treasury Department earlier this month.
The attack was declared a “major incident” after a third-party cybersecurity service provider was compromised, allowing a threat actor to remotely access key financial systems.
The Committee on Foreign Investment in the United States (CFIUS) suffered a data breach as part of the campaign, CNN has revealed. The department reviews foreign investment for national security risks and was recently authorized to investigate property sales near US military bases with the potential to block Chinese investment in the US.
Carefully selected targets
The news is the latest in a series of developments following the US Treasury hack, where hackers were able to gain access used by the breached vendor to override parts of Treasury systems.
The attack has sparked serious concerns among US officials, who have reportedly grown increasingly concerned that the Chinese government or proxies are planning to use land acquisitions to spy on US bases.
In the broader context of the Treasury Department’s attacks, other targets appear to have been chosen with China-US relations in mind. For example, the US sanctions office was hit – which last week issued a sanction to a Chinese company for its alleged role in cyber attacks.
The cyber espionage campaigns launched against US and Western targets in recent months aim not only to steal information and gain access to sensitive data, but also to disrupt critical infrastructure.
In a separate recent attack, the Chinese group Salt Typhoon has reportedly breached 9 major telecommunications companies in a massive campaign against US critical infrastructure. Among the victims were Verizon, AT&T and Lumen Technologies, which had threat actors lurking in their networks for months.
