{"id":58251,"date":"2025-03-05T17:44:08","date_gmt":"2025-03-05T17:44:08","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/chinas-silk-typhoon-tied-to-us-treasury-break-in-now-hammers-it-and-govt-targets\/"},"modified":"2025-03-05T17:44:08","modified_gmt":"2025-03-05T17:44:08","slug":"chinas-silk-typhoon-tied-to-us-treasury-break-in-now-hammers-it-and-govt-targets","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/chinas-silk-typhoon-tied-to-us-treasury-break-in-now-hammers-it-and-govt-targets\/","title":{"rendered":"China’s Silk Typhoon, tied to US Treasury break-in, now hammers IT and govt targets"},"content":{"rendered":"

Silk Typhoon, the Chinese government crew believed to be behind the December US Treasury intrusions, has been abusing stolen API keys and cloud credentials in ongoing attacks targeting IT companies and state and local government agencies since late 2024, according to Microsoft Threat Intelligence.<\/p>\n

The timing of this campaign coincides with that break-in at the US Treasury Department<\/a>, during which Beijing’s cyberspies stole data from workstations belonging to the Office of Foreign Assets Control (OFAC), which administers economic and trade sanctions, as well as the Office of the Treasury Secretary.<\/p>\n

These intrusions were attributed to Silk Typhoon, according to a Bloomberg report<\/a> citing unnamed sources, and the Chinese snoops are believed to have gained access after stealing a BeyondTrust digital key<\/a> used for remote technical support.<\/p>\n