China military unit behind many hacking attacks on U.S., cybersecurity firm says
Updated 5:39 PM ET
A shadowy unit of China's vast army, tucked away in a nondescript office building in the thriving business hub of Shanghai, is behind a huge proportion of the hacking attacks on U.S. websites, according to an American cybersecurity firm.
Mandiant released a detailed 60-page report (PDF) Tuesday claiming its "research and observations indicate that the Communist Party of China is tasking the Chinese People's Liberation Army to commit systematic cyber espionage and data theft against organizations around the world."
Cybersecurity More
NSA identifies "critical vulnerability" in Microsoft Windows 10
Russians hacked Ukrainian firm connected to impeachment
Wawa says data breach affected "potentially all" locations
Ransomware attacks hit 4 U.S. cities this month
Senators want TikTok investigated for "national security risks"
The report says Mandiant tracked thousands of computer attacks on U.S. companies and organizations, starting in 2006 and rapidly increasing right into this year, to one specific neighborhood in Shanghai. Mandiant found that a vast majority of the attacks were coming from one group of hackers, dubbed by the company "Advanced Persistent Threat 1", or APT1.
"We ran into APT1 again and again and again, so we started observing and orienting toward APT1 just because of the volume of attacks they were doing," Mandiant founder and chief executive Kevin Mandia told The New York Times. "After responding to APT1 for years, at over 100 different organizations, you start to pick up patterns ... over 98 percent of the time, when they were doing their intrusions in the U.S. companies, they were also using computer addresses from Shanghai. So I called 98 percent not an anomaly."
Researching the attacks led Mandiant to a tall building on the outskirts of Shanghai, with satellite dishes on the top and a secure perimeter, which houses Unit 61398 of the People's Liberation Army.
"In seeking to identify the organization behind this activity, our research found that People's Liberation Army (PLA's) Unit 61398 is similar to APT1 in its mission, capabilities, and resources. PLA Unit 61398 is also located in precisely the same area from which APT1 activity appears to originate."
The "Cold War for the next generation"
U.S. getting cyber-robbed "every single day"
U.S. weighs action against Beijing after cyberattacks
Mandia told The Times that his company's open-source research showed Unit 61398 is "chartered with hiring people that can speak English, and be able to exploit networks, and know computer security. We thought that was an interesting combination, and that unit just so happens to be located in the same region of Shanghai where we're tracking over 90 percent of the connections coming from."
The report cites an internal 2008 memo from China's state-controlled telecommunications company, China Telecom, purportedly found online by Mandiant. The document appears to detail some of the infrastructure installation at the Unit 61398 building. The author of the memo advises his or her colleagues at the regional branch of China Telecom that the PLA "also hope Shanghai Telecom will smoothly accomplish this task for the military based on the principle that national defense construction is important."
China has repeatedly denied any government involvement in computer hacking.
"Chinese law forbids hacking and any other actions that damage Internet security," a statement from the Defense Ministry said early this year. "The Chinese military has never supported any hacking activities. Cyberattacks are characterized by being cross-national and anonymous. To accuse the Chinese military of launching cyberattacks without firm evidence is not professional and also groundless."
Talking to journalists Tuesday, Foreign Ministry spokesman Hong Lei responded to the report, according to The Associated Press: "To make groundless accusations based on some rough material is neither responsible nor professional." He also said that China, too, has been a target of hackers.
The report comes on the heels of warnings from U.S. lawmakers -- and from Mandiant itself -- that Chinese hackers have been behind a startling wave of cyber attacks on U.S. entities.
Rep. Mike Rogers, R-Mich., who has co-authored cyber security legislation pending in Congress, said in a panel discussion on "Face the Nation" earlier this month that hackers are intent "every single day" on "shutting down our financial services or finding other ways to destroy material in companies that won't allow them to function on a day-to-day basis."
His remarks came after three of the U.S.'s biggest newspapers and Twitter were all targeted by hackers. The New York Times and The Washington Post said the attacks were believed to have originated in China. On Tuesday, CNET reported that Apple was also the target of hackers along with those aforementioned companies.
Speaking to The New York Times for an article published Tuesday, Mandia said his company published its report to alert the U.S. public and government that, "it's not just freelance people in China doing these attacks, it's attacks directed by the government. So that means these attacks can be more advanced they can be more funded, they can be more pervasive, and they will probably continue unabated. It could be the new normal."
Mandia told CBS News correspondent Bob Orr earlier this month that the number and sophistication of the attacks on U.S. organizations is so daunting, it would be futile to try and prevent them all.
"These attacks are inevitable, so let's make sure we keep these attackers from our crown jewels," said Mandia.
To bolster the U.S. defenses against such cyberattacks on vital infrastructure and defense systems, Mandia said it was crucial that entities targeted by hackers start sharing the information on the attacks more fluidly, stressing that "everybody needs to get smarter from each breech, almost like a neighborhood watch."
President Obama signed an executive order on Feb. 12 aimed at boosting the nation's cybersecurity by enabling the government to share information with private firms more easily, and establishing mandatory reporting on security threats from government agencies to U.S. corporations at risk. Congress, however, has been unable to agree on any legislation to set new laws on cybersecurity.
In the wake of attacks on the U.S. newspapers, Orr reported that the Pentagon was pushing to expand its cybersecurity forces. The U.S. military's so-called Cyber Command will grow five-fold over the next few years, from 900 employees at present, to about 5,000 civilian and military personnel, Orr reported.
Edited by CBSNews.com foreign editor Tucker Reals
CBSN Live
Right Rail - Video Promo - Listing
Huey Lewis talks hearing loss
Huey Lewis and the News are in the mood to celebrate, joking about their age as they prepare for the release of what is almost certainly their last album, titled "Weather." At 69, Lewis, who has performed in bands for most of his life, had no intention of slowing down, but his diagnosis of Meniere's Disease – a hearing disorder which has affected his voice – has made the decision for him. John Blackstone reports.
The joyful voices of Zaza Kanto
In the capital of Madagascar, an island nation where nearly 80 percent of people eke out a living on less than $2 a day, an unexpected sound emerges from the slums of the capital, Antananarivo: Zaza Kanto, an a capella group of boys, ages 11 to 16, whose joyful sounds and viral videos have elevated them to national fame. They've also earned praise from Fredo Austin, of the band Freedom's Boombox, who mentored the young men as part of an exchange program called American Music Abroad. Seth Doane reports.
DJ Khaled, the "Quincy Jones of hip hop"
DJ Khaled has worked with some of the biggest artists in music (Rihanna, Justin Bieber, Drake), and he went on tour as Beyoncé's opening act twice. His songs are all-star collaborations, and he's been making hits for more than a decade. Kelefa Sanneh sits down with the son of Palestinian immigrants who's a radio DJ, producer and New York Times bestselling author, who is nominated for a Grammy for the song "Higher," a partnership with John Legend and rapper Nipsey Hussle.
Gustavo Dudamel's musical mission
Conductor Gustavo Dudamel, music director of the Los Angeles Philharmonic, is a rock star of the classical world, and he brings that star power when he meets young musicians in schools and colleges across the country. An ambassador of the sublime, he talks with John Dickerson about the transformative power of music, and shares his infectious excitement in performances that transmit the necessity of making art a part of your life.
Raffi: Songs for the young and young at heart
For more than 40 years the folk singer-turned-rock star to kids has been singing songs to delight multiple generations. Correspondent Serena Altschul sits down with Raffi Cavoukian, whose hits include "Baby Beluga" and "Bananaphone."
Popular On CBS News
Cities with the worst traffic in the world
Traffic software company TomTom has listed the places with the worst traffic delays – and, yes, one U.S. city makes the list.
13H ago 51 photos
New cellphone video appears to show Bryant's helicopter circling near Burbank Airport before the incident.
The president's personal attorney said he first found out about the hold on aid to Ukraine from the media.
Krystal Lee, who was having an affair with a Colorado man and helped him after he beat his fiancee to death with a baseball bat, was sentenced to three years in prison.
They're headed directly for each other but don't pose any danger to Earthlings even if they do hit, experts say. They could produce a spectacular sky show, though.
Right Rail - Gallery Promo
Grammy Awards 2020: Red carpet arrivals
See what music's biggest stars wore on music's biggest night in Los Angeles.
Jan 27 60 photos
Notable deaths in 2020
A look back at the esteemed personalities who've left us this year, who'd touched us with their innovation, creativity and humanity
Jan 20 8 photos
Australia's deadly wildfires
Millions of acres have already burned.
Jan 7 36 photos
Top photos of 2019: The year in pictures
Photographers for The Associated Press captured moments of hope and heartbreak around the world.
Dec 24, 2019 52 photos
New on Netflix, Amazon, Disney+, Hulu and More
Shows and movies you'll want to stream soon.
Latest From CBS News
The coronavirus outbreak that started in central China has left at least 132 people dead and infected thousands around the world.
Transcript: Tom Donilon and Stephen Hadley on "Intelligence Matters"
This week, on "Intelligence Matters," Morell speaks with two former national security advisers about the top national security and foreign policy threats the next commander-in-chief is likely to face.
CBS News On Samsung TV