Today, The Mandiant® Intelligence Center™ released an
report exposing APT1's multi-year, enterprise-scale computer
espionage campaign. APT1 is one of dozens of threat groups Mandiant
tracks around the world and we consider it to be one of the most
prolific in terms of the sheer quantity of information it has
stolen.
Highlights of the report include:
Mandiant is also releasing a digital
appendix with more than 3,000 indicators to bolster defenses against
APT1 operations. This appendix includes:
The scale and impact
of APT1's operations compelled us to write this report. The decision
to publish a significant part of our intelligence about Unit 61398
was a painstaking one. What started as a "what if"
discussion about our traditional non-disclosure policy quickly
turned into the realization that the positive impact resulting from
our decision to expose APT1 outweighed the risk of losing much of
our ability to collect intelligence on this particular APT group. It
is time to acknowledge the threat is originating from China, and we
wanted to do our part to arm and prepare security professionals to
combat the threat effectively. The issue of attribution has always
been a missing link in the public's understanding of the landscape
of APT cyber espionage. Without establishing a solid connection to
China, there will always be room for observers to dismiss APT
actions as uncoordinated, solely criminal in nature, or peripheral
to larger national security and global economic concerns. We hope
that this report will lead to increased understanding and
coordinated action in countering APT network breaches.
We
recognize that no one entity can understand the entire complex
picture that many years of intense cyber espionage by a single group
creates. We look forward to seeing the surge of data and
conversations a report like this will likely generate.
Dan
McWhorter
Managing Director, Threat Intelligence