Ajay Kumar: Created a new article

2023-09-25T18:45:15Z

Created a new article

New page

{{short description|Chinese advanced persistent threat unit}}
{{Expand Chinese|topic=mil|date=February 2013}}
{{Use dmy dates|date=November 2014}}
{{Infobox military unit
| unit_name = People's Liberation Army Unit 61398
| native_name = 61398部队
| image = China Emblem PLA.svg
| caption = Emblem of the People's Liberation Army
| dates = 2014-Present
| country = {{PRC}}
| allegiance = {{CCP flag}}
| command_structure = {{armed forces|China}}
| branch = [[File:PLASSF.svg|23px]] [[People's Liberation Army Strategic Support Force]]
| type = [[Cyber force]], Cyber-espionage Unit
| specialization = [[Cyberwarfare in China|Cyber warfare]] <br> [[Electronic warfare]]
| size =
| garrison = Tonggang Road, [[Pudong]], [[Shanghai]]
| commander1_label =
| commander1 =
| commander2 =
| commander2_label =
| commander3_label =
| commander3 =
| nickname = {{Bulleted list|APT 1|Comment Crew|Comment Panda|GIF89a|Byzantine Candor|Group 3|Threat Group 8223}}
| motto =
| colors =
| march =
| mascot =
| equipment =
| equipment_label =
| battles = * [[GhostNet|Operation GhostNet]]
* [[Operation Aurat ]]
* [[Operation Shady RAT]]
| notable_commanders =
| anniversaries =
| identification_symbol =
}}
'''PLA Unit 61398''' (also known as '''APT 1''', '''Comment Crew''', '''Comment Panda''', '''GIF89a''', and '''Byzantine Candor''') ({{zh|61398部队}}, [[Pinyin]]: 61398 ''bùduì'') is the [[Military Unit Cover Designator]] (MUCD)<ref name=MandiantAPT1>{{cite web|url=http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf|title=APT1: Exposing One of China's Cyber Espionage Units|publisher=Mandiant|access-date=19 February 2013|archive-url=https://web.archive.org/web/20130219155150/http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf|archive-date=19 February 2013|url-status=live}}</ref> of a [[People's Liberation Army]] [[advanced persistent threat]] unit that has been alleged to be a source of Chinese [[hacker (computer security)|computer hacking]] attacks.<ref name="NYT 2013-02-18">{{Cite news |last1=Sanger |first1=David E. |last2=Barboza |first2=David |author-link2=David Barboza |last3=Perlroth |first3=Nicole |date=2013-02-19 |title=Chinese Army Unit Is Seen as Tied to Hacking Against U.S. |language=en-US |work=[[The New York Times]] |url=https://www.nytimes.com/2013/02/19/technology/chinas-army-is-seen-as-tied-to-hacking-against-us.html |access-date=2023-05-28 |issn=0362-4331}}</ref><ref>{{cite web |date=19 February 2013 |title=Chinese military unit behind 'prolific and sustained hacking' |url=https://www.theguardian.com/world/2013/feb/19/chinese-military-unit-prolific-hacking |url-status=live |archive-url=https://web.archive.org/web/20131220122401/http://www.theguardian.com/world/2013/feb/19/chinese-military-unit-prolific-hacking |archive-date=20 December 2013 |access-date=19 February 2013 |work=[[The Guardian]]}}</ref><ref name=":0" /> The unit is stationed in [[Pudong]], [[Shanghai]].<ref>{{Cite web|url=http://www.cs.zju.edu.cn/chinese/redir.php?catalog_id=101913&object_id=106021|title=中国人民解放军61398部队招收定向研究生的通知|date=2004-05-13|website=Zhejiang University|trans-title=A notification of PLA Unit 64398 to recruit postgraduate students as PLA-funded scholarship student.|access-date=2019-01-05|archive-url=https://web.archive.org/web/20161202172240/http://www.cs.zju.edu.cn/chinese/redir.php?catalog_id=101913&object_id=106021|archive-date=2 December 2016|url-status=dead}}</ref>

== History ==
[[File:FBI20140519.jpg|thumb|left|From left, Chinese military officers Gu Chunhui, Huang Zhenyu, Sun Kailiang, Wang Dong, and Wen Xinyu indicted on cyber espionage charges.]]{{See also|Chinese information operations and information warfare|Cyberwarfare by China}}

A 2020 report in [[DNA India]] stated that the unit was involved in espionage on the [[Military of India]].<ref>{{cite web |title=Chinese Army's secret '61398' unit spying on India's defense and research, warns intelligence |url=https://www.dnaindia.com/india/report-chinese-army-s-secret-61398-unit-spying-on-india-s-defense-and-research-warns-intelligence-2835741 |website=[[DNA India]] |language=en}}</ref>

===2014 indictment===

On 19 May 2014, the [[US Department of Justice]] announced that a Federal [[grand jury]] had returned an indictment of five 61398 officers on charges of theft of confidential business information and intellectual property from U.S. commercial firms and of planting [[malware]] on their computers.<ref>Finkle, J., Menn, J., Viswanatha, J. [https://www.reuters.com/article/us-cybercrime-usa-china-idUSKCN0J42M520141120 ''U.S. accuses China of cyber spying on American companies.''] {{Webarchive|url=https://web.archive.org/web/20170412015738/http://www.reuters.com/article/us-cybercrime-usa-china-idUSKCN0J42M520141120 |date=12 April 2017 }} Reuters, 20 Nov 2014.</ref><ref>Clayton, M. [http://www.csmonitor.com/World/Security-Watch/Cyber-Conflict-Monitor/2014/0519/US-indicts-five-in-China-s-secret-Unit-61398-for-cyber-spying-on-US-firms ''US indicts five in China's secret 'Unit 61398' for cyber-spying.''] {{Webarchive|url=https://web.archive.org/web/20140520075207/http://www.csmonitor.com/World/Security-Watch/Cyber-Conflict-Monitor/2014/0519/US-indicts-five-in-China-s-secret-Unit-61398-for-cyber-spying-on-US-firms |date=20 May 2014 }} Christian Science Monitor, 19 May 2014</ref> The five are Huang Zhenyu (黄振宇), Wen Xinyu (文新宇), Sun Kailiang (孙凯亮), Gu Chunhui (顾春晖), and [[Wang Dong (hacker)|Wang Dong]] (王东). Forensic evidence traces the base of operations to a 12-story building off Datong Road in a public, mixed-use area of [[Pudong]] in Shanghai.<ref name="NYT 2013-02-18"/> The group is also known by various other names including "Advanced Persistent Threat 1" ("APT1"), "the Comment group" and "Byzantine Candor", a codename given by US intelligence agencies since 2002.<ref>{{cite web |url=http://www.fiercegovernmentit.com/story/chinese-attacks-byzantine-candor-penetrated-federal-agencies-says-leaked-ca/2010-12-06 |title=Chinese attacks 'Byzantine Candor' penetrated federal agencies, says leaked cable |author=David Perera |date=6 December 2010 |website=fiercegovernmentit.com |publisher=Fierce Government IT |archive-url=https://web.archive.org/web/20160419054340/http://www.fiercegovernmentit.com/story/chinese-attacks-byzantine-candor-penetrated-federal-agencies-says-leaked-ca/2010-12-06 |archive-date=19 April 2016 |url-status=live }}</ref><ref name="CSMonitor">{{cite web|last=Clayton|first=Mark|title=Stealing US business secrets: Experts ID two huge cyber 'gangs' in China|url=http://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China|publisher=[[CSMonitor]]|access-date=24 February 2013|date=14 September 2012|archive-url=https://web.archive.org/web/20191115165311/https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China|archive-date=15 November 2019|url-status=live}}</ref><ref name="Bloomberg EU DC"/><ref>{{cite news|title=China's Comment Group Hacks Europe—and the World|url=http://www.businessweek.com/articles/2012-08-02/chinas-comment-group-hacks-europe-and-the-world|access-date=12 February 2013|newspaper=[[Bloomberg Businessweek]]|date=2 August 2012|author=Michael Riley|author2=Dune Lawrence|archive-url=https://web.archive.org/web/20130219064600/http://www.businessweek.com/articles/2012-08-02/chinas-comment-group-hacks-europe-and-the-world|archive-date=19 February 2013|url-status=dead}}</ref>

A report by the [[computer security]] firm [[Mandiant]] stated that PLA Unit 61398 is believed to operate under the 2nd Bureau of the [[People's Liberation Army General Staff Department]] (GSD) [[People's Liberation Army#Third Department|Third Department]] (总参三部二局)<ref name=MandiantAPT1/> and that there is evidence that it contains, or is itself, an entity Mandiant calls [[APT1]], part of the advanced persistent threat that has attacked a broad range of corporations and government entities around the world since at least 2006. APT1 is described as comprising four large networks in Shanghai, two of which serve the Pudong New Area. It is one of more than 20 APT groups with origins in China.<ref name=MandiantAPT1/><ref>{{cite web|url=http://www.businessinsider.com/china-hacking-pla-unit-61398-2013-2|title=REPORT: An Overwhelming Number Of The Cyber-Attacks On America Are Coming From This Particular Army Building In China|publisher=Business Insider|date=18 February 2013|author=Joe Weisenthal and Geoffrey Ingersoll|access-date=19 February 2013|archive-url=https://web.archive.org/web/20130220095914/http://www.businessinsider.com/china-hacking-pla-unit-61398-2013-2|archive-date=20 February 2013|url-status=live}}</ref> The Third and [[People's Liberation Army#Fourth Department|Fourth Department]], responsible for [[electronic warfare]], are believed to comprise the PLA units mainly responsible for infiltrating and manipulating computer networks.<ref name="huffingtonpost professional">{{cite web|last=Bodeen|first=Christopher|title=Sign That Chinese Hackers Have Become Professional: They Take Weekends Off|url=http://www.huffingtonpost.com/2013/02/25/chinese-hackers_n_2756914.html|work=[[The Huffington Post]]|date=25 February 2013|access-date=27 February 2013|archive-url=https://web.archive.org/web/20130226184036/http://www.huffingtonpost.com/2013/02/25/chinese-hackers_n_2756914.html|archive-date=26 February 2013|url-status=live}}</ref>

The group often compromises internal software "comment" features on legitimate web pages to infiltrate target computers that access the sites, leading it to be known as "the Comment Crew" or "Comment Group".<ref name="NYMag Comment Crew">{{cite web|last=Martin|first=Adam|title=Meet 'Comment Crew,' China's Military-Linked Hackers|url=http://nymag.com/daily/intelligencer/2013/02/meet-comment-crew-chinas-military-hackers.html|work=[[New York (magazine)|NYMag.com]]|publisher=[[New York Media]]|access-date=24 February 2013|date=19 February 2013|archive-url=https://web.archive.org/web/20130222070617/http://nymag.com/daily/intelligencer/2013/02/meet-comment-crew-chinas-military-hackers.html|archive-date=22 February 2013|url-status=live}}</ref><ref>{{cite web|title=The Comment Group: The hackers hunting for clues about you|url=https://www.bbc.co.uk/news/business-21371608|publisher=BBC News|access-date=12 February 2013|author=Dave Lee|date=12 February 2013|archive-url=https://web.archive.org/web/20130212155404/http://www.bbc.co.uk/news/business-21371608|archive-date=12 February 2013|url-status=live}}</ref> The collective has stolen [[trade secret]]s and other confidential information from numerous foreign businesses and organizations over the course of seven years such as [[Lockheed Martin]], [[Telvent]], and other companies in the shipping, aeronautics, arms, energy, manufacturing, engineering, electronics, financial, and software sectors.<ref name="CSMonitor"/>

[[Dell SecureWorks]] says it believed the group includes the same group of attackers behind [[Operation Shady RAT]], an extensive computer espionage campaign uncovered in 2011 in which more than 70 organizations over a five-year period, including the United Nations, government agencies in the United States, Canada, [[South Korea]], Taiwan and Vietnam, were targeted.<ref name="NYT 2013-02-18"/>

The attacks documented in the summer of 2011 represent a fragment of the Comment group's attacks, which go back at least to 2002, according to incident reports and investigators. In 2012, [[FireEye, Inc.]] stated that they had tracked hundreds of targets in the last three years and estimated the group had attacked more than 1,000 organizations.<ref name="Bloomberg EU DC">{{cite news|last1=Riley|first1=Michael|title=Hackers Linked to China's Army Seen From EU to D.C.|url=https://www.bloomberg.com/news/2012-07-26/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor.html|publisher=[[Bloomberg L.P.|Bloomberg]]|access-date=24 February 2013|author2=Dune Lawrence|newspaper=Bloomberg.com|date=26 July 2012|archive-url=https://web.archive.org/web/20150111064254/http://www.bloomberg.com/news/2012-07-26/china-hackers-hit-eu-point-man-and-d-c-with-byzantine-candor.html|archive-date=11 January 2015|url-status=live}}</ref>

Most activity between [[malware]] embedded in a compromised system and the malware's controllers takes place during business hours in Beijing's time zone, suggesting that the group is professionally hired, rather than private hackers inspired by patriotic passions.<ref name="huffingtonpost professional"/>

== Public position of the Chinese government ==
Until 2013, the [[Government of China]] has consistently denied that it is involved in hacking.<ref name="MW Feb 20">{{cite web|last=Xu|first=Weiwei|title=China denies hacking claims|url=http://www.morningwhistle.com/html/2013/PoliticsSociety_0220/217214.html|publisher=Morning Whistle|access-date=8 April 2013|date=20 February 2013|archive-url=https://archive.today/20130629220425/http://www.morningwhistle.com/html/2013/PoliticsSociety_0220/217214.html|archive-date=29 June 2013|url-status=live}}</ref> In response to the [[Mandiant]] Corporation report about Unit 61398, [[Hong Lei (politician)|Hong Lei]], a spokesperson for the [[Ministry of Foreign Affairs of the People's Republic of China|Chinese foreign ministry]], said such allegations were "unprofessional".<ref name="MW Feb 20"/><ref name=":0">{{Cite news |date=February 19, 2013 |title=Hello, Unit 61398 |newspaper=[[The Economist]] |url=https://www.economist.com/analects/2013/02/19/hello-unit-61398 |access-date=2023-05-28 |issn=0013-0613}}</ref>

In 2013, China changed its position and openly admitted to having secretive cyber warfare units in both the military and the civilian part of the government{{snd}}however, the details of their activities were left to speculation.<ref>{{cite news|title=China Finally Admits focusing on Cyber Warfare|url=http://www.ucsusa.org/sites/default/files/attach/2015/03/chinese-nuclear-strategy-full-report.pdf|date=19 March 2015|access-date=13 September 2017|archive-url=https://web.archive.org/web/20170829025423/http://www.ucsusa.org/sites/default/files/attach/2015/03/chinese-nuclear-strategy-full-report.pdf|archive-date=29 August 2017|url-status=live}}</ref> As a show of force towards the rest of the global community the Chinese government now openly lists their abilities when it comes to digital spying and network attack capabilities.<ref name="BBC">{{cite news | url=https://www.bbc.com/news/world-asia-china-22430224 | title=US accuses China government and military of cyber-spying | date=7 May 2013 | access-date=15 January 2019 | author=BBC | work=BBC News | archive-url=https://web.archive.org/web/20190115192443/https://www.bbc.com/news/world-asia-china-22430224 | archive-date=15 January 2019 | url-status=live }}</ref>

== See also ==
* [[Titan Rain]]
* [[Chinese espionage in the United States]]
* [[National Security Agency]] of the United States
* [[PLA Unit 61486]]
* [[Signals intelligence]]
* [[Tailored Access Operations]] of the United States
* [[Mandiant]]
* [[FireEye]]

== References ==
{{Reflist}}

{{-}}
{{Hacking in the 2000s}}
{{Hacking in the 2010s}}
{{China national security}}
{{People's Liberation Army}}

{{coord|31|20|57.43|N|121|34|24.74|E|region:CN_type:landmark_source:MandiantReportPage12|display=title}}

[[Category:Military units and formations of the People's Republic of China]]
[[Category:Cyberwarfare by China]]
[[Category:Chinese advanced persistent threat groups]]
[[Category:Information operations units and formations]]
[[Category:Hacking (computer security)]]
[[Category:Injection exploits]]
[[Category:Web security exploits]]
[[Category:Sabotage]]
[[Category:2002 establishments in China]]
[[Category:Chinese intelligence agencies]]
[[Category:Cybercrime in India]]

PLA Unit 61398 - Revision history

Ajay Kumar: Created a new article