20 February 2013
Mandiant Report "APT1 -- Exposing One of Chinas Cyber Espionage Units"
APT1 is believed to be the 2nd Bureau of the People's Liberation Army (PLA)
General Staff Department's (GSD) 3rd Department, which is most commonly known
by its Military Unit Cover Designator (MUCD) as Unit 61398.
The nature of Unit 61398's work is considered by China to be a state secret;
however, we believe it engages in harmful Computer Network Operations.
Unit 61398 is partially situated on Datong Road in Gaoqiaozhen, which is
located in the Pudong New Area of Shanghai. The central building in this
compound is a 130,663 square foot facility that is 12 stories high and was
built in early 2007.
We estimate that Unit 61398 is staffed by hundreds, and perhaps thousands
of people based on the size of Unit 61398's physical infrastructure.
China Telecom provided special fiber optic communications infrastructure
for the unit in the name of national defense.
Unit 61398 requires its personnel to be trained in computer security and
computer network operations and also requires its personnel to be proficient
in the English language.
Mandiant has traced APT1's activity to four large networks in Shanghai, two
of which serve the Pudong New Area where Unit 61398 is based.