An unusually detailed 60-page study, to be released Tuesday by Mandiant, an American computer security firm, tracks for the first time individual members of the most sophisticated of the Chinese hacking groups \u2014 known to many of its victims in the United States as \u201cComment Crew\u201d or \u201cShanghai Group\u201d \u2014 to the doorstep of the military unit\u2019s headquarters. The firm was not able to place the hackers inside the 12-story building, but makes a case there is no other plausible explanation for why so many attacks come out of one comparatively small area.<\/p>\n
\u201cEither they are coming from inside Unit 61398,\u201d said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week, \u201cor the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.\u201d<\/p>\n
Other security firms that have tracked \u201cComment Crew\u201d say they also believe the group is state-sponsored, and a recent classified National Intelligence Estimate, issued as a consensus document for all 16 of the United States intelligence agencies, makes a strong case that many of these hacking groups are either run by army officers or are contractors working for commands like Unit 61398, according to officials with knowledge of its classified content.<\/p>\n
Mandiant provided an advance copy of its report to The New York Times, saying it hoped to \u201cbring visibility to the issues addressed in the report.\u201d Times reporters then tested the conclusions with other experts, both inside and outside government, who have examined links between the hacking groups and the army (Mandiant was hired by The New York Times Company to investigate a sophisticated Chinese-origin attack on its news operations, but concluded it was not the work of Comment Crew, but another Chinese group. The firm is not currently working for the Times Company but it is in discussions about a business relationship.) <\/p>\n