An inside look at NSA (Equation Group) TTPs from China's lense

Chinese security researchers analyzed NSA (Equation Group) tactics, techniques, and procedures through their investigation of attacks against Northwestern Polytechnical University. The analysis reveals sophisticated tooling including FOXACID browser exploit platform, SECONDDATE network traffic manipulation, and NOPEN remote access malware, deployed across 54 jump servers and 5 proxy servers in 17 countries. The research demonstrates systematic multi-stage cyber espionage operations with careful operational security, using attribution techniques like attack timing analysis and keyboard input language detection to identify human operational patterns. The write-up builds on the joint report by China’s National Computer Virus Emergency Response Center and 360, which attributes the 2022 intrusion to the NSA’s Office of Tailored Access Operations and counts more than 40 NSA-specific tools used against the university. The author points out that none of these claims have been independently verified, so treat it as one side’s attribution story, told in unusual detail. Back in February the same write-up showed up here, along with the AFP coverage of the original 2022 claims.