U.S. Takes Action Against PRC-Linked Cyber Actors for Treasury Hack and Salt Typhoon

The United States is imposing sanctions today on Yin Kecheng and Sichuan Juxinhe Network Technology Co., LTD. (Sichuan Juxinhe), People’s Republic of China (PRC)-linked malicious cyber actors responsible for serious intrusions against U.S. victims.

Yin Kecheng, a Shanghai-based malicious cyber actor and PRC Ministry of State Security affiliate, was associated with the recent compromise of the Department of Treasury’s network. Sichuan Juxinhe is a Sichuan-based cybersecurity company with direct involvement in the Salt Typhoon malicious cyber activities. PRC-linked Salt Typhoon malicious cyber activity is responsible for numerous compromises of U.S. telecommunication and internet service provider companies as part of a broad and significant cyber espionage campaign.

PRC-based hackers pose a persistent and significant threat to our national security and these intrusions into U.S. government systems and critical infrastructure are examples of the PRC’s willingness to operate in a malicious and reckless manner in cyberspace. We are sharing information with countries around the world on how to identify PRC intrusions into their systems and apply best practices to harden their networks.

In addition to sanctions, the U.S. Department of State’s Rewards for Justice (RFJ) program, which is administered by the Diplomatic Security Service, is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, engages in certain malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.

The United States will continue to use all the tools at its disposal to impose costs for, defend against, and deter PRC cyber threats to the safety and security of Americans, U.S. critical infrastructure, and that of our allies and partners.

More information about this reward offer is located on the Rewards for Justice website. The Department of the Treasury sanctions actions today were taken pursuant to Executive Order (E.O.) 13694, as amended. For more information, see Treasury’s press release.