Week of December 30, 2024: Treasury discloses a BeyondTrust-linked breach, and OFAC sanctions Integrity Tech

What mattered to security leaders in the week of December 30, 2024? The US Treasury Department told lawmakers on Monday that a Chinese state-sponsored group had reached its workstations through a compromised BeyondTrust remote support instance, and on Friday Treasury's sanctions office designated Integrity Tech, the Beijing firm tied to the Flax Typhoon group. The holiday week also brought fresh reporting that more US telecom carriers had been hit by Salt Typhoon, and details of a phishing campaign that hijacked at least 35 Chrome extensions.

Treasury says Chinese state hackers got in through BeyondTrust

In a letter to lawmakers reported on December 30, the Treasury Department said its vendor BeyondTrust first notified it of a breach on December 8 and that the incident was attributed to a China state-sponsored APT, which Treasury policy treats as a major cybersecurity incident. Attackers had used a stolen Remote Support SaaS API key and two zero-days, CVE-2024-12356 and CVE-2024-12686, to take over instances, including one Treasury used, and then accessed agency computers and documents. The letter said the FBI and CISA assisted, with no evidence of continued access. Remote support tools with privileged reach are high-value supply chain targets. (BleepingComputer)

OFAC sanctions Integrity Tech over Flax Typhoon intrusions

On January 3 Treasury's Office of Foreign Assets Control sanctioned Integrity Technology Group, a Beijing-based cybersecurity company, for its role in intrusions against US victims attributed to Flax Typhoon, a Chinese state-sponsored group active since at least 2021. OFAC said the actors used Integrity Tech infrastructure between summer 2022 and fall 2023 and in summer 2023 compromised servers and workstations at a California-based entity. The designation freezes US assets and bars US persons from dealing with the firm, adding a compliance angle for any vendor relationships. (US Department of the Treasury, BleepingComputer)

Charter, Consolidated and Windstream named as Salt Typhoon victims

A Wall Street Journal report over the weekend of January 4 and 5, summarized by The Register, added Charter Communications, Consolidated Communications and Windstream to the carriers breached by the Chinese Salt Typhoon campaign; all three declined to comment. The report said the intruders exploited unpatched Fortinet and Cisco network devices and, in at least one breach, took over a high-level network management account without multi-factor authentication that reached more than 100,000 routers. MFA gaps on network administration accounts remained a recurring theme. (The Register)

Phishing campaign hijacked at least 35 Chrome extensions

Reporting on December 31 showed that code first found in Cyberhaven's Chrome extension had been injected into at least 35 extensions used by roughly 2,600,000 people. Developers received emails posing as Chrome Web Store policy warnings that led them to a legitimate Google login page for a malicious OAuth application that requested permission to manage their Chrome Web Store extensions. The campaign began around December 5, 2024, though related infrastructure dated to March 2024. Browser extension allow-listing belongs in endpoint policy. (BleepingComputer)

Four-Faith industrial routers exploited to open reverse shells

VulnCheck reported active exploitation of CVE-2024-12856, a post-authentication command injection flaw in Four-Faith F3x24 and F3x36 routers used in energy, transport, telecom and manufacturing. Many units run default credentials, which makes the authentication step easy to clear, and Censys counted about 15,000 internet-facing devices. VulnCheck said it notified Four-Faith on December 20, and patch availability was unclear when the report ran on December 30. (BleepingComputer)

PAN-OS DNS denial-of-service bug added to the KEV catalog

CISA added CVE-2024-3393, a malformed DNS packet vulnerability in Palo Alto Networks PAN-OS, to its Known Exploited Vulnerabilities catalog on December 30, citing evidence of active exploitation. Firewall management and data-plane services exposed to untrusted traffic stayed on the patch list as the year turned. (CISA)