Science & Technology
US Treasury says Chinese hackers stole documents in ‘major incident’
A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing “firmly opposes the U.S.’s smear attacks against China without any factual basis.”
Chinese state-sponsored hackers breached the U.S. Treasury Department’s computer security guardrails this month and stole documents in what Treasury called a “major incident,” according to a letter to lawmakers, that Treasury officials provided to Reuters on Monday.
The hackers compromised third-party cybersecurity service provider BeyondTrust and were able to access unclassified documents, the letter said.
According to the letter, hackers “gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.”
The Treasury Department said it was alerted to the breach by BeyondTrust on Dec. 8 and that it was working with the U.S. Cybersecurity and Infrastructure Security Agency and the FBI to assess the hack’s impact.
Treasury officials didn’t immediately respond to an email seeking further details about the hack. The FBI did not immediately respond to Reuters’ requests for comment, while CISA referred questions back to the Treasury Department.
A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing “firmly opposes the U.S.’s smear attacks against China without any factual basis.”
A spokesperson for BeyondTrust, based in Johns Creek, Georgia, told Reuters in an email that the company “previously identified and took measures to address a security incident in early December 2024” involving its remote support product. BeyondTrust “notified the limited number of customers who were involved,” and law enforcement was notified, the spokesperson said. “BeyondTrust has been supporting the investigative efforts.”
The spokesperson referred to a statement posted on the company’swebsite, on Dec. 8 sharing some details from the investigation, including that a digital key had been compromised in the incident and that an investigation was under way. That statement was last updated Dec. on 18.
Tom Hegel, a threat researcher at cybersecurity company SentinelOne (S.N), said the reported security incident “fits a well-documented pattern of operations by PRC-linked groups, with a particular focus on abusing trusted third-party services – a method that has become increasingly prominent in recent years,” he said, using an acronym for the People’s Republic of China.”
Science & Technology
Astronomers discover white dwarf surrounded by two rings of planetary debris
Astronomers have discovered a white dwarf star surrounded by two distinct rings of planetary debris, offering new insights into what may happen to planetary systems, including our own, when their host stars reach the end of their lives.
The star, identified as J1328−1450, is located about 1,600 light-years from Earth in the constellation Virgo. Observations made using the European Southern Observatory’s Very Large Telescope in Chile revealed an unusual arrangement of dust and gas around the star.
According to researchers, the debris appears to form two separate rings, a structure not previously observed around any of the 21 white dwarfs known to have surrounding planetary debris.
The scientists believe that two relatively large rocky bodies may have survived the star’s transformation into a white dwarf and could be responsible for shaping the surrounding material. One of these objects may be roughly the size of Pluto, while the other is smaller.
Researchers say the discovery provides further evidence that some rocky planetary bodies can survive the dramatic changes that occur when a star exhausts its fuel and expands into a red giant.
The findings, published in the journal *Nature Astronomy*, suggest that the original star may once have hosted a planetary system. During its expansion, it likely engulfed some of its innermost planets, while more distant objects survived.
Over time, gravitational forces may have pulled some of these surviving bodies closer to the white dwarf, tearing them apart and scattering their material into surrounding rings of dust and gas.
Astronomers also found differences in the chemical composition of the two rings, particularly in their magnesium content, suggesting that they may have originated from different rocky bodies or from different layers of a disrupted object.
The discovery could offer a glimpse into the distant future of our own solar system. Scientists estimate that in about five billion years, the Sun will expand into a red giant before shedding its outer layers and becoming a white dwarf.
During this process, Mercury and Venus are expected to be engulfed, while the fate of Earth remains uncertain. More distant planets, including Jupiter and Saturn, are expected to have a greater chance of surviving.
Researchers say that, after the Sun becomes a white dwarf, surviving planets, moons and asteroids could also be pulled towards it and broken apart by its intense gravitational force.
They suggest that the newly observed system may represent one possible stage in the far-distant future of our solar system.
Science & Technology
Binance says it has covered $6 billion of $6.3 billion stolen in hack
The US Federal Bureau of Investigation (FBI) said on Saturday the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.
Binance, the world’s biggest cryptocurrency exchange, said it has covered $6 billion of the $6.3 billion stolen from its platform by using company money to buy replacement tokens, after a hack that US officials said was carried out by a North Korean state-sponsored unit known as TraderTraitor.
“We had already covered $6B of the impacted amount of the hacked loss,” Binance said on X on Saturday, after saying earlier that it had covered 90% of the stolen funds, Reuters reported.
The remaining amount, now less than 10%, consists of assets that are less liquid and may take longer to source in the required amounts, according to Binance.
The US Federal Bureau of Investigation (FBI) said on Saturday the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.
North Korea has for years denied using state-linked cyber units for espionage, financial theft and revenue. Its mission in Geneva and embassy in China did not respond to requests for comment.
Members of the unit were observed by law enforcement converting stolen assets into the cryptocurrency ethereum, the FBI said in a statement, adding that it expects “further laundering” of the assets through the use of related technology.
Analysts had previously blamed North Korea and said it could be the largest financial heist of all time.
Binance has been working with industry partners to freeze some of the affected assets, with about $3 billion located as of Friday.
The company has repeatedly said it would bear the financial impact of the funds stolen in the hack.
The money spent re-buying tokens came from using part of its $1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund, and the company’s own corporate treasury, it said on X.
Co-CEO Yi He said on Saturday that 50% of its SAFU funds would be used, while the company said it was committing to replenishing the fund to return it to about $1 billion.
Crypto prices fell on Friday, while Binance sought to reassure customers that their funds were safe after the hack.
Co-CEO Richard Teng had said that the breach was a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
After the hack, the exchange stopped allowing customers to withdraw their funds, but it said on Saturday it was still on track to reopen withdrawals on Sunday.
Withdrawals were not open as of 02:50 GMT on Sunday.
Binance said it has set aside around $6.34 billion of company funds internally to cover the losses.
Binance also said it had taken a new snapshot of assets held on its platform as of 0000 GMT on October 31, as part of its proof-of-reserves process.
Users holding the 10 listed tokens — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC — would be able to verify that their assets were backed at a minimum ratio of 1:1 once the full proof was available, it said.
Science & Technology
Governments take websites offline as critical cyber flaws trigger global alert
Security patches were released prompting authorities to urge organisations to update affected systems immediately or take vulnerable services offline until they could be secured.
Governments and organisations across Europe and beyond have taken websites and online services offline after the discovery of two critical vulnerabilities in widely used web software triggered an international cyber-security alert.
The vulnerabilities affect PHP, a programming language used extensively to operate websites and online applications. Attackers could potentially exploit the flaws to execute malicious code remotely on vulnerable servers, threatening sensitive information and digital infrastructure.
Security patches were released on Wednesday, October 21, prompting authorities to urge organisations to update affected systems immediately or take vulnerable services offline until they could be secured.
The Netherlands, Finland, France, Belgium and Germany have also reported precautionary shutdowns affecting government websites and other public-facing services.
In the Netherlands, affected platforms included Overheid.nl, MijnOverheid.nl and DigiD. The country’s National Cyber Security Centre also temporarily took its own website offline.
Finland’s state IT services provider, Valtori, suspended public government web services as a precaution, while France’s Interior Ministry temporarily took the websites of local administrative authorities offline.
In Belgium, the Foreign Ministry took its websites offline amid concerns about potential exploitation, although the country’s cybersecurity centre said it had not observed attacks on Belgian websites at the time.
Germany’s federal IT service provider also temporarily disabled several websites, with officials saying the measure was precautionary and no security incidents were known to have occurred.
The disruption extended beyond government agencies. Websites and online services belonging to hospitals, educational platforms and other organisations were also affected, highlighting the potential reach of vulnerabilities in widely deployed software.
In Australia, the Australian Cyber Security Centre’s website, cyber.gov.au, was among the government services affected by the security alert. Australian authorities said they were not aware of active exploitation of the vulnerabilities.
In the United States, the National Security Agency and other cybersecurity authorities urged organisations to prepare for immediate updates and take vulnerable systems offline if they could not be secured promptly. The Wikimedia Foundation, which operates Wikipedia, also took some systems offline as a precaution while addressing the flaws.
Cybersecurity company Cloudflare reported seeing early attacks associated with the vulnerabilities, although reports of exploitation do not establish that every affected organisation suffered a breach.
The incident highlights the risks created by the internet’s reliance on shared software. PHP is used across a substantial proportion of websites, meaning a single vulnerability can affect organisations in multiple countries and sectors simultaneously.
Security specialists have urged website operators to identify affected systems, install the relevant patches and examine server logs for signs of unauthorised access. Applying an update may prevent further exploitation, but organisations must also investigate whether attackers gained access before their systems were secured.
Authorities have not established that all affected websites were breached. The precautionary shutdowns are intended to reduce exposure while administrators apply fixes and verify that their systems are safe to restore.
The alert has underscored the challenge facing governments and businesses in responding to critical software vulnerabilities that can rapidly become an international security concern.
-
Sport3 days agoAfghanistan’s record partnership highlights fourth day of Test against Zimbabwe
-
World3 days agoHouthi-run health ministry says airstrikes kill 33 near Yemen capital
-
Sport4 days agoToofan Herat defeat Arman FC 2–0 in Afghanistan Champions League
-
Sport5 days agoAbu Muslim Farah claim convincing 3-0 win over Omar Zawak in ACL
-
Sport3 days agoAfghanistan thrash Senegal 6-0 to reach Dakar Youth Olympics futsal semi-finals
-
Regional4 days agoPakistan’s leaders dread US Democrats’ win but its households are praying for it
-
Sport2 days agoPortugal beat Afghanistan 2-0 in Dakar Youth Olympics futsal semi-finals
-
Business4 days agoUK-Afghanistan trade falls 16.7% to £70 million over 12 months
