Threat actors entered Treasury Department systems through BeyondTrust. The breach may be related to the Salt Typhoon attacks.

The US Treasury Department told lawmakers in a letter back in December that its documents and workstations were accessed by an external party in a security breach. It described the attack as "a major cybersecurity incident" and attributed it to a "China state-sponsored Advanced Persistent Threat actor.

Liu Pengyu, a spokesperson for the Chinese Embassy in Washington, D.C., denied the U.S. government’s attribution of the cyberattack to the Chinese government, arguing that the United States did not present evidence of its claims.