Unit 61398 is partially situated on Datong Road(大同路) in Gaoqiaozhen (高桥镇), which islocated in the Pudong New Area (浦东新区) ofShanghai (上海). The central building in thiscompound is a 130,663 square foot facility thatis 12 stories high and was built in early 2007. * Mandiant APT1 report 2013
We estimate that Unit 61398 is staffed byhundreds, and perhaps thousands of peoplebased on the size of Unit 61398’s physicalinfrastructure.
“Unit 61398 requires its personnel to betrained in computer security and computernetwork operations and also requires itspersonnel to be proficient in the Englishlanguage.” * Mandiant APT1 report 2013
“They have systematically stolen hundreds ofterabytes of data from at least 141organizations, and has demonstrated thecapability and intent to steal from dozens oforganizations simultaneously”* * Mandiant APT1 report 2013
“Among other large-scale thefts of intellectualproperty, we have observed them stealing 6.5terabytes of compressed data from a singleorganization over a ten-month time period.” * Mandiant APT1 report 2013
Attack process Initial Establish Lateral Complete Initial recon Movement compromize foothold mission Maintain Internal presence Recon Escalate privileges