Harbin Games Targeted by Alleged NSA Operations Amid Rising Cyber Tensions

A Bold Accusation

April 15, 2025: On April 15, 2025, Chinese authorities publicly accused the U.S. National Security Agency (NSA) of orchestrating sophisticated cyberattacks during the 2025 Asian Winter Games held in Harbin, China, from February 7 to 14. The Chinese Ministry of Public Security named three NSA agents—Katheryn A. Wilson, Robert J. Snelling, and Stephen W. Johnson—as suspects and issued wanted notices for their arrest. This marks a rare instance of China attributing cyberattacks to a specific foreign agency.

National Computer Virus Emergency Response Center published a report regarding cyber attacks on the information systems for the 2025 Harbin Asian Winter Games. (DDN)

Details of the Alleged Attacks

According to China’s National Computer Virus Emergency Response Center (CVERC), the cyberattacks targeted critical infrastructure in Heilongjiang province, including energy, transportation, and defense sectors. The attacks aimed to disrupt China’s information systems, incite social disorder, and steal confidential data. The NSA allegedly used anonymous international servers and IP addresses to obscure their operations and exploited pre-installed backdoors in Microsoft Windows systems. The University of California and Virginia Tech were also cited as being involved, though specifics were not provided.

International Reactions

The U.S. Embassy in Beijing has not commented on the allegations. This development comes amid escalating U.S.-China tensions, including a trade war and cyber espionage accusations from both sides. While China denies involvement in offensive cyber operations, recent years have seen Beijing push back with its own accusations of U.S. cyber intrusion, including claims of NSA attacks on Chinese enterprises like Huawei.

Implications for Global Cybersecurity

This public attribution of cyberattacks by China represents a significant shift in the cyber espionage landscape. It reflects China’s growing confidence in its cyber capabilities and its willingness to confront perceived adversaries directly. The incident underscores the increasing risks of cyber warfare and the challenges of attributing and responding to cyberattacks in the international arena.