Treasury hackers also breached US foreign investments review office

Silk Typhoon (aka Hafnium), a Chinese state-backed APT, reportedly used a stolen BeyondTrust Remote Support API key to breach Treasury Department systems including CFIUS and OFAC, likely accessing unclassified documents related to potential sanctions; the campaign fits a pattern of nation-state cyberespionage leveraging stolen credentials and zero-day exploits. Investigators say the breach appears limited to Treasury and there is no confirmed persistent access after the compromised BeyondTrust instance was disabled.