China’s National Computer Virus Emergency Response Centre (NCVERC) released a report accusing the US National Security Agency of conducting cyberattacks against China’s Northwestern Polytechnical University. The university is an “aeronautical and military research-oriented” research and training center in the city of Xi’an. According to the US DOJ, the researchers “[work] closely with the People’s Liberation Army on the advancement of its military capabilities.” NCVERC’s report asserts that the Office of Tailored Access Operations (TAO), a “cyber-warfare intelligence-gathering unit” of the NSA, “carried out tens of thousands of malicious cyberattacks on China’s domestic network targets… and stole more than 140GB of high-value data” during June 2022. For initial access, TAO allegedly used two zero-day exploits against the SunOS Linux operating system used by the university. NCVERC identified forty (40) different cyber tools that were used in the attacks for backdoor access, information stealing, and persistence. Examples of these tools include “OPEN Trojan,” “Fury Spray,” “Cunning Heretics,” “Stoic Surgeon,” and “Acid Fox,” some of which have been used in previous attacks. This is not the first time China has accused the US of using cyber weapons to steal information and hack Chinese devices. In February, Chinese security-research laboratory Pangu Lab discovered a previously unknown backdoor “Bvp47” and attributed it to the TAO-linked Equation Group. In April, the NCVERC released a report attributing the malware platform “Hive” to the US Central Intelligence Agency (CIA). While Chinese media has condemned the US for cyber aggression citing these recent reports, security professionals have spoken out against them. Catalin Cimpanu, writer of the Risky Biz security newsletter, writes: “The reports and claims lacked any substantial evidence that there was any actual hacking taking place. No new malware was being discovered, officials always cited old historical events, and the vast majority of reports seemed to have been copied from Wikipedia pages.” CTIX analysts are monitoring this situation and will provide updates for any new developments.