“I can’t believe we’re seeing command injection vulnerabilities in 2024 in any product, let alone a secure remote access product that needs additional vetting to be used by the US government, ” said Jake Williams, vice president of research and development at the cybersecurity consultancy Hunter Strategy and a former NSA hacker. “These are some of the easiest bugs to identify and fix at this point.”

BeyondTrust is an accredited “Federal Risk and Authorization Management Program” vendor, but Williams speculates that it is possible that the Treasury uses a non-FedRAMP version of the company’s Remote Support and Privileged Remote Access cloud products. If the breach actually affects FedRAMP-certified cloud infrastructure, however, Williams says, “this could be the first breach of one and almost certainly the first time FedRAMP cloud tools have been abused to facilitate remote access.” access to customer systems.”

The breach comes as US officials scramble to address a massive espionage campaign compromise of US telecoms attributed to China-backed hacking group known as Salt Typhoon. White House officials said the reporters on Friday that the Salt Typhoon breached nine US telecoms.

“We don’t leave our homes, our offices, unlocked and yet our critical infrastructure—the private companies that own and operate our critical infrastructure—often don’t have basic cybersecurity practices in place that will make our infrastructure more dangerous, expensive, and more difficult. for countries and criminals to attack,” Anne Neuberger, deputy national security adviser for cyber and emerging technology, said on Friday.

Treasury, CISA, and FBI officials did not respond to WIRED’s questions about whether the actor who breached Treasury was specifically Salt Typhoon. Treasury officials said in a disclosure to Congress that they will provide more information about the incident in the Department’s mandated 30-day supplemental notification report. As details continue to emerge, Hunter Strategy’s Williams says the scale and scope of the breach may be larger than it currently appears.

“I hope the impact will be more significant than just accessing a few anonymous documents,” he said.