US Treasury incident a clear warning on supply chain security in 2025

With this incident, BeyondTrust unfortunately becomes the latest in a long-line of cyber security specialists to find themselves making headlines after the compromise of products and solutions designed to keep end-users safe.

Avishai Avivi, CISO at SafeBreach, a supplier of breach and attack simulation tools, explained how the breach likely unfolded. “BeyondTrust, unironically, provides a secure method for IT support personnel to provide remote support to end users,” he said. “This method involves establishing a trusted connection between the support person and the end-user.

“This trusted connection punches through traditional perimeter security controls and gives the support person full access and control over the end-user workstation. Once inside, the support person can send documents back over that secure channel or masquerade as the end-user and send the same documents directly.

“The security controls protecting the US Treasury network have no way of knowing something nefarious is happening, as the trusted connection is, well, trusted.

“Was there something that the US Treasury could have done to prevent this? The sad answer appears to be yes. Again, referring to the technical information BeyondTrust provided, the system administrators at the US Treasury, or the vendor likely to provide support services, failed to configure trusted locations from which the support agents could connect. We refer to this as IP whitelisting [allowlisting].

“This failure is a critical risk with any such service [and] the same issue led to notable breaches in 2023 and 2024. This oversight is why we urge all service vendors, especially trusted ICT vendors, to follow the CISA Secure-by-Default guidance.”