For years, Washington has accused Beijing of instigating cyberattacks against the US and its allies. Now, a Chinese cybersecurity firm says it has identified hacking within China by a group linked to the National Security Agency, hinting at a rethink of how Beijing handles its geopolitical rival.

Chinese officials and companies like Huawei Technologies Co have often responded to US accusations in the past by declaring America the worst cyber-offender of all, pointing in particular to Edward Snowden’s revelations about US espionage.

But this week, Pangu Lab said it discovered US-sponsored hacking activity on Chinese soil. It said it found malware in domestic IT systems it claims was created by hacking group Equation, which is “generally believed” to be linked to the US National Security Agency. In a report issued Feb 23 and covered by the Communist Party-backed Global Times, Pangu Lab said the malware, called Bvp47, had been discovered within “a key Chinese department” in 2013 and 2015. Pangu Lab claimed the malware infiltrated systems to monitor and track key institutions in 45 countries around the world, including US allies, in a campaign that lasted 10 years.

The report marked a departure from Beijing’s typical stance. Faced with allegations of hacking, China has routinely denied the behaviour and labelled the US an “empire of hackers”. Beijing responded to recent reporting that Chinese spies used Huawei to hack an Australian telecommunications network by calling the accusations an “arbitrary smear”, “groundless” and “irresponsible”.

But the effectiveness of that approach has been questioned, including by former Global Times editor-in-chief Hu Xijin. In a recent WeChat post, the widely followed journalist said Chinese officials have been unwilling to provoke its geopolitical rivals and their tactic of relying heavily on statistics was ineffective.

“It is dry,” he wrote on Feb 21. “When have you ever seen a fresh face in China, facing the camera and angrily scolding Washington: The cyber hackers you support attacked our computer system!”

That might be…