An inside look at NSA (Equation Group) TTPs from China’s lense

According to Chinese cybersecurity firms Qihoo 360 and CVERC, the NSA’s Equation Group (APT-C-40) allegedly conducted a sophisticated cyberattack on Northwestern Polytechnical University in 2022, using over 40 unique malware tools and techniques like the FOXACID browser exploitation platform and SECONDDATE network hijacking tool. The attack focused on edge network devices, used multiple jump servers across 17 countries, and employed advanced persistence and lateral movement techniques to steal research data, with investigators tracing the attack through detailed analysis of operational patterns, tool signatures, and human errors. The claims go back to a September 2022 report by CVERC and Qihoo 360, which attributed the intrusion to the NSA’s Office of Tailored Access Operations (TAO) and counted 54 jump servers and proxies. As AFP reported at the time, the report also claimed TAO exploited unknown SunOS flaws and stole more than 140 GB of data, while the NSA did not respond to a request for comment. The same write-up came up again in July, with a closer look at the attribution by attack timing and keyboard input language.