Military Wiki
in: Articles containing Chinese-language text, Articles incorporating text from Wikipedia, Military units and formations of the People's Liberation Army,
and 10 more

PLA Unit 61398

Sign in to edit

PLA Unit 61398 (Chinese: 61398部队) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that has been alleged to be the source of Chinese computer hacking attacks.[2][3] Forensic evidence traces the base of operations to a 12-story building off Datong Road in a public, mixed-use area of Pudong in Shanghai.[2] The group is also known by various other names including "Advanced Persistent Threat 1" ("APT1") and "Byzantine Candor", a codename given by US intelligence agencies since 2002.[4][5][6][7]

A report by the computer security firm Mandiant stated that PLA Unit 61398 is elieved to operate under the 2nd Bureau of the People's Liberation Army General Staff Department (GSD) Third Department Second Board (总参三部二局).[1] and that there is evidence that it contains, or is itself, an entity Mandiant calls APT1, part of the advanced persistent threat that has attacked a broad range of corporations and government entities around the world since at least 2006. APT1 is described as comprising four large networks in Shanghai, two of which serve the Pudong New Area. It is one of more than 20 APT groups with origins in China.[1][8] The Third and Fourth Department, responsible for electronic warfare, are believed to be comprise the PLA units mainly responsible for infiltrating and manipulating computer networks.[9] The group often compromises internal software "comment" features on legitimate web pages to infiltrate target computers that access the sites.[10][11] The collective has stolen trade secrets and other confidential information from numerous foreign businesses and organizations over the course of seven years such as Lockheed Martin, Telvent, and other companies in the shipping, aeronautics, arms, energy, manufacturing, engineering, electronics, financial, and software sectors.[5]

Dell SecureWorks says it believed the group includes the same group of attackers behind Operation Shady RAT, an extensive computer espionage campaign uncovered in 2011 in which more than 70 organizations over a five-year period, including the United Nations, government agencies in the United States, Canada, South Korea, Taiwan and Vietnam were targeted.[2]

The attacks documented in the summer of 2011 represent a fragment of the Comment group's attacks, which go back at least to 2002, according to incident reports and investigators. FireEye, Inc. alone has tracked hundreds of targets in the last three years and estimates the group has attacked more than 1,000 organizations.[6]

Most activity between malware embedded in a compromised system and the malware's controllers takes place during business hours in Beijing's time zone, suggesting that the group is professionally hired, rather than private hackers inspired by patriotic passions.[9] The Unit is belived to be "staffed by perhaps thousands of people proficient in English as well as computer programming and network operations."[12]

The government of China has consistently denied that it is involved in hacking.[12] In response to the Mandiant Corporation report about Unit 61398, Hong Lei, a spokesperson for the Chinese foreign ministry, said such allegations were "irresponsible and unprofessional."[12][13]

See also[]

References[]

  1. ↑ 1.0 1.1 1.2 "APT1: Exposing One of China’s Cyber Espionage Units". Mandiant. http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf. Retrieved 2013-02-19. 
  2. ↑ 2.0 2.1 2.2 David E. Sanger, David Barboza and Nicole Perlroth (18 February 2013). "Chinese Army Unit Is Seen as Tied to Hacking Against U.S.". New York Times. http://www.nytimes.com/2013/02/19/technology/chinas-army-is-seen-as-tied-to-hacking-against-us.html?emc=na&_r=1&. Retrieved 19 February 2013. 
  3. ↑ "Chinese military unit behind 'prolific and sustained hacking'". The Guardian. 19 February 2013. http://www.guardian.co.uk/world/2013/feb/19/chinese-military-unit-prolific-hacking. Retrieved 2013-02-19. 
  4. ↑ David Perera, Chinese attacks 'Byzantine Candor' penetrated federal agencies, says leaked cable, Fierce Government IT, December 6, 2010
  5. ↑ 5.0 5.1 Clayton, Mark (14 September 2012). "Stealing US business secrets: Experts ID two huge cyber 'gangs' in China". CSMonitor. http://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China. Retrieved 24 February 2013. 
  6. ↑ 6.0 6.1 Riley, Michael; Dune Lawrence (26 July 2012). "Hackers Linked to China’s Army Seen From EU to D.C.". Bloomberg. http://www.bloomberg.com/news/2012-07-26/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor.html. Retrieved 24 February 2013. 
  7. ↑ Michael Riley; Dune Lawrence (August 2, 2012). "China's Comment Group Hacks Europe—and the World". http://www.businessweek.com/articles/2012-08-02/chinas-comment-group-hacks-europe-and-the-world. Retrieved February 12, 2013. 
  8. ↑ Joe Weisenthal and Geoffrey Ingersoll (Feb 18, 2013). "REPORT: An Overwhelming Number Of The Cyber-Attacks On America Are Coming From This Particular Army Building In China". Business Insider. http://www.businessinsider.com/china-hacking-pla-unit-61398-2013-2. Retrieved 2013-02-19. 
  9. ↑ 9.0 9.1 Bodeen, Christopher (25 February 2013). "Sign That Chinese Hackers Have Become Professional: They Take Weekends Off". The Huffington Post. http://www.huffingtonpost.com/2013/02/25/chinese-hackers_n_2756914.html. Retrieved 27 February 2013. 
  10. ↑ Martin, Adam (19 February 2013). "Meet ‘Comment Crew,’ China’s Military-Linked Hackers". NYMag.com. New York Media. http://nymag.com/daily/intelligencer/2013/02/meet-comment-crew-chinas-military-hackers.html. Retrieved 24 February 2013. 
  11. ↑ Dave Lee (February 12, 2013). "The Comment Group: The hackers hunting for clues about you". BBC News. http://www.bbc.co.uk/news/business-21371608. Retrieved February 12, 2013. 
  12. ↑ 12.0 12.1 12.2 Xu, Weiwei (20 February 2013). "China denies hacking claims". Morning Whistle. http://www.morningwhistle.com/html/2013/PoliticsSociety_0220/217214.html. Retrieved 8 April 2013.  Cite error: Invalid <ref> tag; name "MW Feb 20" defined multiple times with different content
  13. ↑ "Hello, Unit 61398". 19 February 2013. http://www.economist.com/blogs/analects/2013/02/chinese-cyber-attacks?spc=scode&spv=xm&ah=9d7f7ab945510a56fa6d37c30b6f1709. Retrieved 5 March 2013. 

Coordinates: 31°20′57.43″N 121°34′24.74″E / 31.3492861°N 121.5735389°E / 31.3492861; 121.5735389

All or a portion of this article consists of text from Wikipedia, and is therefore Creative Commons Licensed under GFDL.
The original article can be found at PLA Unit 61398 and the edit history here.
Community content is available under CC-BY-SA unless otherwise noted.