A CYBER security investigation by a Mandiant Intelligence Report left little in doubt that China’s government-sponsored APT1 is attacking commercial entities in the U.S.
Today, China denies the allegations. From the New York Times:
A day after a United States security company accused a People’s Liberation Army unit in Shanghai of engaging in cyberwarfare against American corporations, organizations and government agencies, China’s defense ministry issued a strong denial and insisted that the report was flawed.
At a news conference in Beijing Wednesday, the ministry suggested that the allegations were destructive and challenged the study, which was produced by Mandiant, an American computer security company. The report identified P.L.A. Unit 61398 in Shanghai as one of the most aggressive computer hacking operations in the world.
Part of what Mandiant found:
Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China’s cyber threat actors. The scale and impact of APT1’s operations compelled us to write this report. In an attempt to bolster defenses against APT1 operations Mandiant is also releasing more than 3,000 indicators as part of the appendix to this report, which can be used with our free tools and our commercial products to search for signs of APT attack activity.
Highlights of the report include:
- APT1 is believed to be the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, which is most commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.
- APT1 has systematically stolen hundreds of terabytes of data from at least 141 organizations.
- APT1 focuses on compromising organizations across a broad range of industries in English-speaking countries.
- APT1 maintains an extensive infrastructure of computer systems around the world.
- In over 97% of the 1,905 times Mandiant observed APT1 intruders connecting to their attack infrastructure, APT1 used IP addresses registered in Shanghai and systems set to use the Simplified Chinese language.
- The size of APT1’s infrastructure implies a large organization with at least dozens, but potentially hundreds of human operators.
- In an effort to underscore that there are actual individuals behind the keyboard, Mandiant is revealing three personas that are associated with APT1 activity.
- Mandiant is releasing more than 3,000 indicators to bolster defenses against APT1 operations.
The argument in the U.S. is that our government uses cyberwarfare to keep Americans safe, while what’s being alleged is happening through China is a direct targeting of commercial entities.
Considering China want U.S. businesses in their country, the whole enterprise would seem very counterintuitive.
The evidence against China seems impressive, especially when you consider the piracy that’s been going on over intellectual creative properties for years.