Chinese state-sponsored cyber actors have been observed deleting files using rm or del commands. Several files that the cyber actors target would be timestomped, in order to show different times compared to when those files were created/used.