Chinese law enforcement places NSA operatives on wanted list over alleged cyberattacks

The allegations, supported by the foreign ministry, are more specific and aggressive than usual and say the U.S. sought to disrupt the Asian Winter Games.

China stepped up its allegations of U.S. cyberattacks Tuesday, with local law enforcement saying they were investigating three National Security Agency operatives they had placed on a wanted list and a national official condemning the alleged attacks.

State media outlet Xinhau advanced the claims in two stories, one detailing a hacking campaign during the Asian Winter Games alleged by the Harbin Public Security Bureau and another pinned to a briefing from Chinese foreign ministry spokesperson Lin Jian.

“China condemns the above-mentioned malicious cyber activity by the U.S. government,” Lin said. “We urge the U.S. to take a responsible attitude on the cybersecurity issue, and stop any attack, including cyberattack, and groundless vilification against China.”

China has in recent years begun pointing the finger back at the United States, which has accused Beijing of backing a litany of cyberattack, but Tuesday’s allegations were more specific and aggressive than usual. Relations have soured further between China and the United States under the Trump administration as both nations escalate tariffs.

The Wall Street Journal reported this week that China had privately acknowledged Beijing was behind a series of cyberattacks on U.S. infrastructure. The remarks were “indirect and somewhat ambiguous, but most of the American delegation in the room interpreted it as a tacit admission and a warning to the U.S. about Taiwan, a former U.S. official familiar with the meeting” told the newspaper.

As detailed in the Xinhau account, police in Harbin, the capital of the Heilongjiang Province, the NSA’s alleged focus was the Asian Winter Games.

“Investigations revealed that the NSA focused its pre-event cyberattacks on critical systems of the Asian Winter Games, including registration, arrival/departure management, and competition entry platforms, authorities said,” the story reads. “These systems, essential for pre-event operations, stored vast amounts of sensitive personal data of individuals associated with the Games.”

Chinese technical teams reportedly conducted investigations that concluded the NSA’s Tailored Access Operations Office carried out the attacks using front organizations to purchase IP addresses and rent servers anonymously. The goal, apparently, was to undermine normal operations of the Asian Winter Games.

The NSA also allegedly launched cyberattacks on critical infrastructure sectors in the Heilongjiang Province and had “transmitted unknown encrypted data packets” to devices running Microsoft Windows in an attempt to “activate or trigger pre-implanted backdoors.” And the NSA operatives also had launched attacks against companies such as Huawei, the Xinhau account states.

According to the story, technical teams implicated the University of California and Virginia Tech in the attacks as well.

The NSA and the University of California did not immediately respond to a request for comment. A Virginia Tech spokesperson said in a statement to CyberScoop that the university “does not engage in cyber attacks.”

“We have found no evidence that these allegations are true,” the spokesperson added. “If someone has evidence to the contrary, we will immediately investigate and work with the proper law enforcement agencies.”

This story was updated April 16, 2025, with comments from Virginia Tech.

Former NSA chiefs worry American offensive edge in cybersecurity is slipping

A systemic numbness to cyberattacks has exposed the U.S. economy and its institutions to ever-widening threats. Retired four-star military officials worry the worst day in cyber is…

US charges hacker tied to Russian groups that targeted water systems and meat plants

Top Senate Intel Dem warns of ‘catastrophic’ cyber consequences of Trump admin national security firings, politicization

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure