"China strongly condemns it," Mao said. "The United States should immediately stop using its advantages to steal secrets and attack other countries."
The American Embassy in Beijing didn't immediately respond to a request for comment.
Security experts say the ruling Communist Party's military wing, the People's Liberation Army, and the Ministry of State Security also sponsor hackers outside the government.
Northwestern Polytechnical University, in the western city of Xi'an, is on a US government "entity list" that limits its access to American technology. Washington says the university helps the PLA develop aerial and underwater drones and missile technology.
China accused the United States of taking information about the university's network management and other "core technologies." It said Chinese analysts found 41 "network attack" tools that it said were traced to the NSA.
Last year, a Chinese man, Shuren Qin, was sentenced to two years in prison by a federal court in Boston after he pleaded guilty to exporting underwater and marine technology to Northwestern Polytechnical University without required licenses.
The NSA, part of the Department of Defence, is responsible for "signals intelligence", or obtaining communications and other data.
The Computer Virus Emergency Response Centre, set up in 1996 by the police department of the eastern city of Tianjin, describes itself as the Chinese agency responsible for the inspection and testing of anti-computer virus products.
A report by Qihoo 360 in 2020 said hacking tools used in attacks on Chinese companies and government agencies in 2008-19 were traced to the Central Intelligence Agency by comparing them with code in CIA tools disclosed by the Wikileaks group.
The virus centre accused the NSA of carrying out other "malicious network attacks" in China but gave no details. It said 13 people involved in the attacks had been identified.
The hackers targeted a "zero-day", or previously unreported, vulnerability in the school's security, the statement said. It said the break-ins were conducted from servers in 17 countries including Japan, South Korea, Sweden, Poland, Ukraine and Colombia.
The statement described what it said were NSA software tools with names such as "Second Date" and "Drinking Tea" but didn't say which might have been used at the university.
- AP