Daily Report: Chinese Army Unit Is Tied to Hacking Against U.S.

A growing body of digital forensic evidence â€" confirmed by American intelligence officials who say they have tapped into the activity of the army unit for years â€" leaves little doubt that an overwhelming percentage of the attacks on American corporations, organizations and government agencies originate in and around the headquarters of the People’s Liberation Army in Shanghai.

David E. Sanger, David Barboza and Nicole Perlroth of The New York Times report that an unusually detailed 60-page study, to be released Tuesday by Mandiant, an American computer security firm, tracks for the first time individual members of the most sophisticated of the Chinese hacking groups â€" known to many of its victims in the United States as “Comment Crew” or “Shanghai Group.”

“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chie executive of Mandiant, in an interview last week, “or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.”

Other security firms that have tracked “Comment Crew” say they also believe the group is state-sponsored, and a recent classified National Intelligence Estimate, issued as a consensus document for all 16 of the United States intelligence agencies, makes a strong case that many of these hacking groups are either run by army officers or are contractors working for commands like Unit 61398, according to officials with knowledge of its classified content.

Increasingly its focus is on companies involved in the critical infrastructure of the United States â€" its electrical power grid, gas lines and waterworks. According to the security researchers, one target was a company with remote access to more than 60 percent of oil and gas pipelines in North America.

The United States government is planning to begin a more aggressive defense against Chinese hacking groups, starting on Tuesday. Under a directive signed by President Obama last week, the government plans to share with American Internet providers information it has gathered about the unique digital signatures of the largest of the groups, including Comment Crew and others emanating from near where Unit 61398 is based.