Chinese cyber-spies reportedly targeted sanctions intel in US Treasury raid

The report describes a Chinese state-sponsored intrusion that used a stolen BeyondTrust Remote Support SaaS API key to remotely access some U.S. Treasury workstations and exfiltrate certain unclassified documents, including material from the Office of Foreign Assets Control (OFAC); BeyondTrust patched affected cloud instances and notified impacted customers. The Treasury attributed the breach to a China-backed APT actor and investigators identified DigitalOcean-hosted IP addresses connected to the activity; the article also references other major China-linked incidents such as the Salt Typhoon telecom intrusions.