Loading story…
China’s Ministry of State Security publicly accused the United States National Security Agency (NSA) of conducting a series of cyberattacks against the China National Time Service Center (NTSC), a critical institution responsible for maintaining and distributing the country’s official time standard. According to Chinese authorities, the NSA began its operations on March 25, 2022, by exploiting vulnerabilities in the messaging services of a foreign mobile phone brand used by NTSC staff. This initial compromise allegedly allowed the NSA to steal sensitive data and monitor communications from employees’ devices. On April 18, 2023, the attackers reportedly escalated their access by using stolen credentials to infiltrate the center’s computer systems and further map its network. Between August 2023 and June 2024, the NSA is said to have deployed a new cyber warfare platform, utilizing 42 specialized cyber tools to attack multiple internal network systems, target a precision timing system, and plant disruptive code within the NTSC infrastructure. Chinese officials emphasized that the NTSC provides essential timing services to sectors such as telecommunications, finance, energy, transportation, mapping, and defense, and that any disruption could have significant consequences for national infrastructure and global time standards. The Ministry of State Security claimed to have obtained “irrefutable evidence” of the NSA’s involvement, though it did not publicly release technical details or proof. The attacks reportedly occurred late at night, suggesting a deliberate attempt to avoid detection. Chinese authorities stated that they had thwarted the NSA’s attempts to steal secrets and sabotage systems, thereby safeguarding the security of “Beijing Time.” The Ministry also provided guidance to the NTSC to eliminate the identified risks and strengthen its defenses. The public accusation comes amid ongoing tensions between the US and China over cybersecurity, trade, technology, and geopolitical issues. Chinese officials framed the incident as an example of the US engaging in the same cyber activities it frequently accuses China of conducting. The US Embassy did not immediately respond to requests for comment on the allegations. The incident highlights the strategic importance of time synchronization infrastructure and the potential impact of cyberattacks on national and global systems. Western governments have previously accused Chinese state-linked hackers of targeting officials, journalists, and corporations, but this case marks a rare public accusation by China against the US for a specific cyber operation. The disclosure is likely to further strain relations between the two countries and increase scrutiny of cyber activities targeting critical infrastructure.
TTPs, infrastructure, and targeting history in one profile.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcenextgov.com
Open sourcethehackernews.com
Open sourcecyberscoop.com
Open sourcecsoonline.com
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourceapnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked hacking groups were reported to have penetrated a wide range of targets across the United States and allied regions, including manufacturers, U.S. government email systems, internet providers, and major telecommunications networks. Earlier reporting described broad economic espionage aimed at stealing trade secrets from manufacturing sectors in the U.S., Europe, and Asia, while later disclosures said Chinese operators breached U.S. government email accounts through Microsoft cloud infrastructure and infiltrated American internet providers for surveillance. Subsequent investigations tied the telecom intrusions to the **Salt Typhoon** campaign, which officials said exposed sensitive metadata and provided insight into U.S. surveillance targets. U.S. officials characterized the activity, alongside related operations such as **Volt Typhoon**, as one of the most serious cyber threats to American critical infrastructure in recent years. Reporting said investigators believed the attackers may have retained access to at least eight telecom firms, including **Verizon** and **AT&T**, and that the campaign extended to dozens of telecoms and government agencies. In response, the Biden administration moved to bar the remaining U.S. operations of **China Telecom Americas**, citing national security risks and signaling the first public retaliatory step tied to the telecom compromises, even as debate continued over broader sanctions, technology restrictions, and offensive cyber responses.
Jun 29, 2026
National Cyber Director Sean Cairncross emphasized the urgent need for the United States to counter China's efforts to export surveillance technologies and promote a global "clean American tech stack." Speaking at the 2025 Meridian Summit, Cairncross highlighted concerns over Chinese cyber operations targeting critical US infrastructure and called for stronger messaging and engagement with international partners to deter such activities. He argued that the US has not sufficiently signaled to China that its cyber behavior is unacceptable and poses strategic risks to American interests. Simultaneously, analysis of international technical standards reveals that China has been actively shaping the protocols governing critical infrastructure worldwide by dominating standards bodies and committees. Chinese engineers and ministries have increased their influence in setting specifications for technologies such as 6G wireless, industrial automation, and port operations, giving Beijing significant leverage over global systems. This influence, combined with evidence of Chinese cyber campaigns targeting US infrastructure, underscores the strategic challenge posed by China's dual approach of technical standard-setting and cyber operations.
Jun 29, 2026
SentinelLABS reported that China’s Computer Virus Emergency Response Center (**CVERC**) published another report alleging that the **U.S. government**, rather than China, was responsible for **Volt Typhoon** activity, but the analysis found the document offered no new evidence. The report was presented as part of a broader messaging effort that sought to recast a widely tracked cyber-espionage campaign and shift blame away from Beijing. According to SentinelLABS, the publication fits a recurring state-directed influence pattern in which Chinese cybersecurity firms, **CVERC**, state media, and official channels amplify accusations of U.S. hacking using older leaked intelligence material. The campaign was assessed as aiming to weaken support for U.S. **Section 702** surveillance authorities, bolster efforts to remove foreign technology such as **Microsoft** from Chinese government systems, and divert attention from recent Chinese espionage incidents in Europe; its release in multiple languages, including Japanese, French, and German, also indicated an effort to shape opinion beyond China.
Jun 29, 2026