More than one hundred cyberattacks against U.S. companies have been traced back to a neighborhood near Shanghai, said a report by U.S. computer security firm Mandiant Corp. on Tuesday.
Mandiant claimed the attacks likely originated from “Unit 61398” of the People’s Liberation Army, whose headquarters is a 12-story building within the suspected neighborhood.
“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week with The New York Times, “Or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.”
The report cited more than 140 victims ranging from energy corporations to military contractors, with attacks dating back as far as 2006. Increasingly, however, the attacks have been against companies operating vital US infrastructure such as power grids, gas lines and water supplies, according to the Times.
“From our observations, it is one of the most prolific cyber espionage groups in terms of the sheer quantity of information stolen,” the Mandiant report said.
In more than 97 percent of these monitored attacks, Mandiant traced the infiltrating IP addresses to Shanghai and determined the system was “set to use the Simplified Chinese Language.”
Chinese officials denied these allegations, citing that China has never condoned hacking — military or otherwise.
“The Chinese government has always firmly combated such activities and the Chinese military has never supported any form of hacking activity,” the Chinese Defense Ministry said in a statement faxed to The Associated Press.
“Statements to the effect that the Chinese military takes part in Internet attacks are unprofessional and are not in accordance with the facts.”
The Mandiant report surfaced exactly one week after President Barack Obama proposed his executive order to increase national cybersecurity in his State of the Union speech.
“We know hackers steal people’s identities and infiltrate private e-mail,” Obama said in the address. “We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy.”
Though Obama’s executive order encourages and gives incentives for companies to adopt more contemporary methods of cybersecurity, the order is not legally binding and adoption remains voluntary.
However, congressional legislation may be on the horizon. According to Reuters, Republican Rep. Mike Rogers, chair of the House Intelligence Committee, is expected to reintroduce a cybersecurity bill which includes liability protection for companies.
Rogers’ bill passed in the House of Representatives but not the Senate last year, due to concerns over sharing private information with the federal government.