News / Asia

US-China Cyber Spying Case Turns Spotlight on Shadowy Unit 61398

Part of the building of 'Unit 61398', a secretive Chinese military unit, is seen in the outskirts of Shanghai, Feb. 19, 2013.
Part of the building of 'Unit 61398', a secretive Chinese military unit, is seen in the outskirts of Shanghai, Feb. 19, 2013.
Reuters
A tense stand-off between the United States and China over state-backed cyber espionage has dragged China's secretive hacking unit “61398” back into focus, after the military group was pinpointed last year for mounting cyber attacks on Western commercial targets.
 
U.S. authorities on Monday charged five Chinese military officers at the unit, accusing them of hacking into American nuclear, metal and solar firms to steal trade secrets. China on Tuesday summoned the U.S. ambassador in Beijing and warned it would retaliate if Washington followed through with the charges. It said the affair would damage “mutual trust.”
 
At the center of the argument is a nondescript tower block in the northern suburbs of China's financial capital Shanghai, home to Chinese People's Liberation Army (PLA) Unit 61398.
 
The 12-story block houses as many as several thousand staff, according to Mandiant, a U.S. cyber security firm recently acquired by global network security company FireEye Inc. Mandiant identified the location as the source of a large number of espionage operations in a 70-page report last year.
 
“This unit is one of the most prolific. The group is really active and very aggressive,” said Pierluigi Paganini, a cyber security expert and founder of Security Affairs, based in Italy.
 
Unit 61398's Shanghai base is kitted out with specialist fiber optic lines, while staff are trained in areas from English linguistics to covert communications, network security and cyber attack strategy, according to the Mandiant report.
 
The unit's operatives, working under code names such as “UglyGorilla”, “DOTA” and “SuperHard”, also have close research and recruitment ties with China's leading academic centers such as the prestigious Shanghai Jiaotong University.
 
Publicly available academic reports, school registers, recruitment notices and local online community notice boards show a web of social, educational and academic networks spreading out from the cyber spying unit. Military units in China are often organized in this way with schools, sports clubs and social events organized communally for unit members.
 
Tip of the iceberg

 
However, unit 61398 - more formally known as General Staff Department (GSD), Third Department, Second Bureau - is just one of dozens of similar groups based in China, and far from the foremost, said Mandiant analyst Jen Weedon.
 
“The unit is one of many and its tradecraft is not that great. They are one of the ones that doesn't seem to mind leaving traces behind,” she told Reuters.
 
The unit, which started operating in or before 2006, saw activity drop sharply in the wake of the 2013 Mandiant report, but has since returned to “business as usual” after it overhauled some of its hacking techniques, Weedon added.
 
The new allegations are that Chinese state-owned firms “hired” the unit, which used a range of cyber attack methods to illegally gather corporate information from mostly U.S. firms and help give Chinese companies a competitive edge.
 
The unit “stole sensitive, internal communications”, using tactics such as “spear phishing” emails to gain access to employees' computers, after which it was able to collect internal data, according to the indictment document, posted on the United States Department of Justice website.
 
Federal prosecutors said the suspects targeted companies including Alcoa Inc, Allegheny Technologies Inc., United States Steel Corp, Toshiba Corp unit Westinghouse Electric Co, the U.S. subsidiaries of SolarWorld AG , and a steel workers' union.
 
Unit 61398 - or at least one very much like it - also stole data from at least one U.S. government agency in a hacking campaign named 'Byzantine Candor', according to diplomatic cables released by Wikileaks.
 
“Hackers based in Shanghai and linked to the PRC's People's Liberation Army [PLA] Third Department” stole data from at least one U.S. government agency, according to a leaked 2008 cable.
 
Officials in Washington have argued for years that cyber espionage is a top national security concern, and the battle is heating up. Both sides have ramped up public and private confrontation, including at a summit last year between U.S. President Barack Obama and Chinese President Xi Jinping.
 
China has denied the unit is involved in cyber espionage, and insists the country is more a victim than a perpetrator of cyber attacks.
 
Paganini said he was not surprised at the latest turn of events, which he described as just the “tip of the iceberg”.
 
“I believe there's an ongoing battle in the cyberspace. These countries are investing large amounts in cyber units that are able to create specific malware and have the ability to get into foreign networks and computers to steal trade secrets and intellectual properties,” he said.

You May Like

Polls Open in Scotland Independence Vote

As race to persuade undecided voters continues, 'No' voters say they believe life in Scotland will slowly improve, 'Yes' vote not worth the risk More

China to Invest $20 billion In India Amid Border Dispute

Border spat between armies of two countries in Himalayas underlines mutual tensions despite growing commercial ties highlighted by Xi Jinping's high profile visit More

Ukrainian Activist in Despair About Future of Her Country

IrIna Dovgan, accused of being a spy and tortured by pro-Russian separatists, is appealing to UN Human Rights Council to support her country More

Featured Videos

Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
A Dinosaur Fit for Land and Wateri
X
September 17, 2014 8:44 PM
Residents and tourists in Washington D.C. can now examine a life-size replica of an unusual dinosaur that lived almost a hundred million years ago in northern Africa. Scientists say studying the behemoth named Spinosaurus helps them better understand how some prehistoric animals adapted to life on land and in water. The Spinosaurus replica is on display at the National Geographic museum. VOA’s George Putic has more.
Video

Video A Dinosaur Fit for Land and Water

Residents and tourists in Washington D.C. can now examine a life-size replica of an unusual dinosaur that lived almost a hundred million years ago in northern Africa. Scientists say studying the behemoth named Spinosaurus helps them better understand how some prehistoric animals adapted to life on land and in water. The Spinosaurus replica is on display at the National Geographic museum. VOA’s George Putic has more.
Video

Video Iraqi Kurdistan Church Helps Christian Children Cope find shelter in churches in the Kurdish capital, Irbil

In the past six weeks, tens of thousands of Iraqi Christians have been forced to flee their homes by Islamic State militants and find shelter in churches in the Kurdish capital, Irbil. Despite U.S. airstrikes in the region, the prospect of people returning home is still very low and concerns are starting to grow over the impact this is having on the displaced youth. Sebastian Meyer reports from Irbil on how one church is coping.
Video

Video NASA Picks Boeing, SpaceX to Carry Astronauts Into Space

The U.S. space agency, NASA, has chosen Boeing and SpaceX companies to build the next generation of spacecraft that will carry U.S. astronauts to the International Space Station by the year 2017. The deal with private industry enables NASA to end its dependence on Russia to send space crews into low Earth orbit and back. Zlatica Hoke has more.
Video

Video Future of Ukrainian Former President's Estate Uncertain

More than six months after Ukraine's former President Viktor Yanukovych fled revolution to Russia, authorities have yet to gain control of his palatial estate. Protesters occupy the grounds and opened it to tourists but they are also refusing to turn it over to the state. VOA's Daniel Schearf reports from Mezhigirya, just north of Kyiv.
Video

Video China Muslims Work to Change Perceptions After Knife Attacks

China says its has sentenced three men to death and one woman to life in prison for a deadly knife attack in March that left more than 30 dead and 140 injured. Beijing says Muslim militants from China's restive western region of Xinjiang carried out the attacks. Now, more than six months after the incident, residents in the city are still coping with the aftermath. VOA's Bill Ide has more from Kunming.
Video

Video Enviropreneur Seeks to Save the Environment, Empower the Community

Lorna Rutto, a former banker, is now an ‘enviropreneur’ - turning plastic waste into furniture and fences discusses the challenges she faces in Africa with raw materials and the environment.
Video

Video West Trades Accusations Over Ransoms

As world leaders try to forge a common response to the threat posed by Islamic State militants in Iraq and Syria, there is simmering tension over differing policies on paying ransoms. In the past month, the jihadist group has beheaded two Americans and one Briton. Both countries refuse to pay ransom money. As Henry Ridgwell reports for VOA from London, there is uncertainty in the approach of some other European nations.
Video

Video Scotland Independence Bid Stokes Global Interest

The people of Scotland are preparing to vote on whether to become independent and break away from the rest of Britain, in a referendum being watched carefully in many other countries. Some see it as a risky experiment; while others hope a successful vote for independence might energize their own separatist demands. Foreign immigrants to Scotland have a front row seat for the vote. VOA’s Henry Ridgwell spoke to some of them in Edinburgh.


Carnage and mayhem are part of daily life in northern Nigeria, the result of a terror campaign by the Islamist group Boko Haram. Fears are growing that Nigeria’s government may not know how to counter it, and may be making things worse. More

AppleAndroid