NSA
The National Security Agency (NSA) is referenced in the content in the context of sophisticated hardware implant capabilities, specifically the NSA’s COTTONMOUTH devices, which are cited as inspiration for advanced USB-based hardware implants enabling covert access. No additional NSA targeting, operational details, sub-groups, or TTPs beyond this hardware-implant reference are directly provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
56 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alleged to have exploited vulnerabilities in messaging services of a foreign mobile phone brand to steal sensitive information from the Chinese National Time Center.
Allegedly conducting long-term, highly covert cyber operations against China’s National Time Service Center, including compromising staff mobile devices, stealing sensitive data, and attempting to infiltrate internal networks. The operations reportedly escalated in 2023 with the deployment of a new cyberwarfare platform targeting high-precision timing networks.
The NSA is accused of conducting cyber-espionage operations against China’s National Time Service Center, targeting sensitive data and critical infrastructure related to national timekeeping. The operations reportedly involved exploiting mobile phone vulnerabilities, credential theft, network infiltration, and deployment of a cyber warfare platform with multiple tools for data theft and disruption.
Allegedly conducted a cyber attack against China's National Time Service Center, targeting critical timekeeping infrastructure that supports communications, finance, power, transportation, defense, and other sectors. The operation reportedly involved exploiting an SMS vulnerability to compromise mobile devices of staff and steal sensitive data, with the potential to disrupt national and international time services.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.