超级军网纽约时报：土鳖的61398网络战部队在蛰伏三个月后又开始 ...
来源：百度文库 编辑：超级军网 时间：2024/04/25 09:23:09
美国《纽约时报》前天报道说，土鳖在上海浦东的61398黑客部队在蛰伏三个月后又开始活动了，而且该部队已经升级了其网上攻击的手段。三个月前，61398部队在被美国的网络安全公司Mandiant锁定后停止了网上攻击的活动。但美国人现在在Xi总访美前夕突然又来拿61398部队说事儿，问题不简单呐。
Mandiant声称的位于上海浦东的所谓解放军61398黑客部队大楼：
美国《纽约时报》登载的报道原文的电子版：
http://www.nytimes.com/2013/05/20/world/asia/chinese-hackers-resume-attacks-on-us-targets.html?pagewanted=all&_r=1&
----------------------------
Hackers From China Resume Attacks on U.S. Targets
WASHINGTON — Three months after hackers working for a cyberunit of China’s People’s Liberation Army went silent amid evidence that they had stolen data from scores of American companies and government agencies, they appear to have resumed their attacks using different techniques, according to computer industry security experts and American officials.
The Obama administration had bet that “naming and shaming” the groups, first in industry reports and then in the Pentagon’s own detailed survey of Chinese military capabilities, might prompt China’s new leadership to crack down on the military’s highly organized team of hackers — or at least urge them to become more subtle.
But Unit 61398, whose well-guarded 12-story white headquarters on the edges of Shanghai became the symbol of Chinese cyberpower, is back in business, according to American officials and security companies.
It is not clear precisely who has been affected by the latest attacks. Mandiant, a private security company that helps companies and government agencies defend themselves from hackers, said the attacks had resumed but would not identify the targets, citing agreements with its clients. But it did say the victims were many of the same ones the unit had attacked before.
The hackers were behind scores of thefts of intellectual property and government documents over the past five years, according to a report by Mandiant in February that was confirmed by American officials. They have stolen product blueprints, manufacturing plans, clinical trial results, pricing documents, negotiation strategies and other proprietary information from more than 100 of Mandiant’s clients, predominantly in the United States.
According to security experts, the cyberunit was responsible for a 2009 attack on the Coca-Cola Company that coincided with its failed attempt to acquire the China Huiyuan Juice Group. In 2011, it attacked RSA, a maker of data security products used by American government agencies and defense contractors, and used the information it collected from that attack to break into the computer systems of Lockheed Martin, the aerospace contractor.
More recently, security experts said, the group took aim at companies with access to the nation’s power grid. Last September, it broke into the Canadian arm of Telvent, now Schneider Electric, which keeps detailed blueprints on more than half the oil and gas pipelines in North America.
Representatives of Coca-Cola and Schneider Electric did not return requests for comment on Sunday. A Lockheed Martin spokesman said the company declined to comment.
In interviews, Obama administration officials said they were not surprised by the resumption of the hacking activity. One senior official said Friday that “this is something we are going to have to come back at time and again with the Chinese leadership,” who, he said, “have to be convinced there is a real cost to this kind of activity.”
Mandiant said that the Chinese hackers had stopped their attacks after they were exposed in February and removed their spying tools from the organizations they had infiltrated. But over the past two months, they have gradually begun attacking the same victims from new servers and have reinserted many of the tools that enable them to seek out data without detection. They are now operating at 60 percent to 70 percent of the level they were working at before, according to a study by Mandiant requested by The New York Times.
The Times hired Mandiant to investigate an attack that originated in China on its news operations last fall. Mandiant is not currently working for The New York Times Company.
Mandiant’s findings match those of Crowdstrike, another security company that has also been tracking the group. Adam Meyers, director of intelligence at Crowdstrike, said that apart from a few minor changes in tactics, it was “business as usual” for the Chinese hackers.
The subject of Chinese attacks is expected to be a central issue in an upcoming visit to China by President Obama’s national security adviser, Thomas Donilon, who has said that dealing with China’s actions in cyberspace is now moving to the center of the complex security and economic relationship between the two countries.
But hopes for progress on the issue are limited. When the Pentagon released its report this month officially identifying the Chinese military as the source of years of attacks, the Chinese Foreign Ministry denied the accusation, and People’s Daily, which reflects the views of the Communist Party, called the United States “the real ‘hacking empire,’ ” saying it “has continued to strengthen its network tools for political subversion against other countries.” Other Chinese organizations and scholars cited American and Israeli cyberattacks on Iran’s nuclear facilities as evidence of American hypocrisy.
At the White House, Caitlin Hayden, the spokeswoman for the National Security Council, said Sunday that “what we have been seeking from China is for it to investigate our concerns and to start a dialogue with us on cyberissues.” She noted that China “agreed last month to start a new working group,” and that the administration hoped to win “longer-term changes in China’s behavior, including by working together to establish norms against the theft of trade secrets and confidential business information.”
In a report to be issued Wednesday, a private task force led by Mr. Obama’s former director of national intelligence, Dennis C. Blair, and his former ambassador to China, Jon M. Huntsman Jr., lays out a series of proposed executive actions and Congressional legislation intended to raise the stakes for China.
“Jawboning alone won’t work,” Mr. Blair said Saturday. “Something has to change China’s calculus.”
The exposure of Unit 61398’s actions, which have long been well known to American intelligence agencies, did not accomplish that task.
One day after Mandiant and the United States government revealed the P.L.A. unit as the culprit behind hundreds of attacks on agencies and companies, the unit began a haphazard cleanup operation, Mandiant said.
Attack tools were unplugged from victims’ systems. Command and control servers went silent. And of the 3,000 technical indicators Mandiant identified in its initial report, only a sliver kept operating. Some of the unit’s most visible operatives, hackers with names like “DOTA,” “SuperHard” and “UglyGorilla,” disappeared, as cybersleuths scoured the Internet for clues to their real identities.
In the case of UglyGorilla, Web sleuths found digital evidence that linked him to a Chinese national named Wang Dong, who kept a blog about his experience as a P.L.A. hacker from 2006 to 2009, in which he lamented his low pay, long hours and instant ramen meals.
But in the weeks that followed, the group picked up where it had left off. From its Shanghai headquarters, the unit’s hackers set up new beachheads from compromised computers all over the world, many of them small Internet service providers and mom-and-pop shops whose owners do not realize that by failing to rigorously apply software patches for known threats, they are enabling state-sponsored espionage.
“They dialed it back for a little while, though other groups that also wear uniforms didn’t even bother to do that,” Kevin Mandia, the chief executive of Mandiant, said in an interview on Friday. “I think you have to view this as the new normal.”
The hackers now use the same malicious software they used to break into the same organizations in the past, only with minor modifications to the code.
While American officials and corporate executives say they are trying to persuade President Xi Jinping’s government that a pattern of theft by the P.L.A. will damage China’s growth prospects — and the willingness of companies to invest in China — their longer-term concern is that China may be trying to establish a new set of rules for Internet commerce, with more censorship and fewer penalties for the theft of intellectual property.
Eric Schmidt, the chairman of Google, said Friday that while there was evidence that inside China many citizens are using the Web to pressure the government to clean up industrial hazards or to complain about corruption, “so far there is no positive data on China’s dealings with the rest of the world” on cyberissues.
Google largely pulled out of China after repeated attacks on its systems in 2009 and 2010, and now has its Chinese operations in Hong Kong. But it remains, Mr. Schmidt said, a constant target for Chinese cyberattackers.
David E. Sanger reported from Washington, and Nicole Perlroth from San Francisco.
A version of this article appeared in print on May 20, 2013, on page A1 of the New York edition with the headline: Chinese Hackers Resume Attacks On U.S. Targets.
美国《纽约时报》前天报道说，土鳖在上海浦东的61398黑客部队在蛰伏三个月后又开始活动了，而且该部队已经升级了其网上攻击的手段。三个月前，61398部队在被美国的网络安全公司Mandiant锁定后停止了网上攻击的活动。但美国人现在在Xi总访美前夕突然又来拿61398部队说事儿，问题不简单呐。
Mandiant声称的位于上海浦东的所谓解放军61398黑客部队大楼：
美国《纽约时报》登载的报道原文的电子版：
http://www.nytimes.com/2013/05/20/world/asia/chinese-hackers-resume-attacks-on-us-targets.html?pagewanted=all&_r=1&
----------------------------
Hackers From China Resume Attacks on U.S. Targets
WASHINGTON — Three months after hackers working for a cyberunit of China’s People’s Liberation Army went silent amid evidence that they had stolen data from scores of American companies and government agencies, they appear to have resumed their attacks using different techniques, according to computer industry security experts and American officials.
The Obama administration had bet that “naming and shaming” the groups, first in industry reports and then in the Pentagon’s own detailed survey of Chinese military capabilities, might prompt China’s new leadership to crack down on the military’s highly organized team of hackers — or at least urge them to become more subtle.
But Unit 61398, whose well-guarded 12-story white headquarters on the edges of Shanghai became the symbol of Chinese cyberpower, is back in business, according to American officials and security companies.
It is not clear precisely who has been affected by the latest attacks. Mandiant, a private security company that helps companies and government agencies defend themselves from hackers, said the attacks had resumed but would not identify the targets, citing agreements with its clients. But it did say the victims were many of the same ones the unit had attacked before.
The hackers were behind scores of thefts of intellectual property and government documents over the past five years, according to a report by Mandiant in February that was confirmed by American officials. They have stolen product blueprints, manufacturing plans, clinical trial results, pricing documents, negotiation strategies and other proprietary information from more than 100 of Mandiant’s clients, predominantly in the United States.
According to security experts, the cyberunit was responsible for a 2009 attack on the Coca-Cola Company that coincided with its failed attempt to acquire the China Huiyuan Juice Group. In 2011, it attacked RSA, a maker of data security products used by American government agencies and defense contractors, and used the information it collected from that attack to break into the computer systems of Lockheed Martin, the aerospace contractor.
More recently, security experts said, the group took aim at companies with access to the nation’s power grid. Last September, it broke into the Canadian arm of Telvent, now Schneider Electric, which keeps detailed blueprints on more than half the oil and gas pipelines in North America.
Representatives of Coca-Cola and Schneider Electric did not return requests for comment on Sunday. A Lockheed Martin spokesman said the company declined to comment.
In interviews, Obama administration officials said they were not surprised by the resumption of the hacking activity. One senior official said Friday that “this is something we are going to have to come back at time and again with the Chinese leadership,” who, he said, “have to be convinced there is a real cost to this kind of activity.”
Mandiant said that the Chinese hackers had stopped their attacks after they were exposed in February and removed their spying tools from the organizations they had infiltrated. But over the past two months, they have gradually begun attacking the same victims from new servers and have reinserted many of the tools that enable them to seek out data without detection. They are now operating at 60 percent to 70 percent of the level they were working at before, according to a study by Mandiant requested by The New York Times.
The Times hired Mandiant to investigate an attack that originated in China on its news operations last fall. Mandiant is not currently working for The New York Times Company.
Mandiant’s findings match those of Crowdstrike, another security company that has also been tracking the group. Adam Meyers, director of intelligence at Crowdstrike, said that apart from a few minor changes in tactics, it was “business as usual” for the Chinese hackers.
The subject of Chinese attacks is expected to be a central issue in an upcoming visit to China by President Obama’s national security adviser, Thomas Donilon, who has said that dealing with China’s actions in cyberspace is now moving to the center of the complex security and economic relationship between the two countries.
But hopes for progress on the issue are limited. When the Pentagon released its report this month officially identifying the Chinese military as the source of years of attacks, the Chinese Foreign Ministry denied the accusation, and People’s Daily, which reflects the views of the Communist Party, called the United States “the real ‘hacking empire,’ ” saying it “has continued to strengthen its network tools for political subversion against other countries.” Other Chinese organizations and scholars cited American and Israeli cyberattacks on Iran’s nuclear facilities as evidence of American hypocrisy.
At the White House, Caitlin Hayden, the spokeswoman for the National Security Council, said Sunday that “what we have been seeking from China is for it to investigate our concerns and to start a dialogue with us on cyberissues.” She noted that China “agreed last month to start a new working group,” and that the administration hoped to win “longer-term changes in China’s behavior, including by working together to establish norms against the theft of trade secrets and confidential business information.”
In a report to be issued Wednesday, a private task force led by Mr. Obama’s former director of national intelligence, Dennis C. Blair, and his former ambassador to China, Jon M. Huntsman Jr., lays out a series of proposed executive actions and Congressional legislation intended to raise the stakes for China.
“Jawboning alone won’t work,” Mr. Blair said Saturday. “Something has to change China’s calculus.”
The exposure of Unit 61398’s actions, which have long been well known to American intelligence agencies, did not accomplish that task.
One day after Mandiant and the United States government revealed the P.L.A. unit as the culprit behind hundreds of attacks on agencies and companies, the unit began a haphazard cleanup operation, Mandiant said.
Attack tools were unplugged from victims’ systems. Command and control servers went silent. And of the 3,000 technical indicators Mandiant identified in its initial report, only a sliver kept operating. Some of the unit’s most visible operatives, hackers with names like “DOTA,” “SuperHard” and “UglyGorilla,” disappeared, as cybersleuths scoured the Internet for clues to their real identities.
In the case of UglyGorilla, Web sleuths found digital evidence that linked him to a Chinese national named Wang Dong, who kept a blog about his experience as a P.L.A. hacker from 2006 to 2009, in which he lamented his low pay, long hours and instant ramen meals.
But in the weeks that followed, the group picked up where it had left off. From its Shanghai headquarters, the unit’s hackers set up new beachheads from compromised computers all over the world, many of them small Internet service providers and mom-and-pop shops whose owners do not realize that by failing to rigorously apply software patches for known threats, they are enabling state-sponsored espionage.
“They dialed it back for a little while, though other groups that also wear uniforms didn’t even bother to do that,” Kevin Mandia, the chief executive of Mandiant, said in an interview on Friday. “I think you have to view this as the new normal.”
The hackers now use the same malicious software they used to break into the same organizations in the past, only with minor modifications to the code.
While American officials and corporate executives say they are trying to persuade President Xi Jinping’s government that a pattern of theft by the P.L.A. will damage China’s growth prospects — and the willingness of companies to invest in China — their longer-term concern is that China may be trying to establish a new set of rules for Internet commerce, with more censorship and fewer penalties for the theft of intellectual property.
Eric Schmidt, the chairman of Google, said Friday that while there was evidence that inside China many citizens are using the Web to pressure the government to clean up industrial hazards or to complain about corruption, “so far there is no positive data on China’s dealings with the rest of the world” on cyberissues.
Google largely pulled out of China after repeated attacks on its systems in 2009 and 2010, and now has its Chinese operations in Hong Kong. But it remains, Mr. Schmidt said, a constant target for Chinese cyberattackers.
David E. Sanger reported from Washington, and Nicole Perlroth from San Francisco.
A version of this article appeared in print on May 20, 2013, on page A1 of the New York edition with the headline: Chinese Hackers Resume Attacks On U.S. Targets.
Mandiant声称的位于上海浦东的所谓解放军61398黑客部队大楼：
美国《纽约时报》登载的报道原文的电子版：
http://www.nytimes.com/2013/05/20/world/asia/chinese-hackers-resume-attacks-on-us-targets.html?pagewanted=all&_r=1&
----------------------------
Hackers From China Resume Attacks on U.S. Targets
WASHINGTON — Three months after hackers working for a cyberunit of China’s People’s Liberation Army went silent amid evidence that they had stolen data from scores of American companies and government agencies, they appear to have resumed their attacks using different techniques, according to computer industry security experts and American officials.
The Obama administration had bet that “naming and shaming” the groups, first in industry reports and then in the Pentagon’s own detailed survey of Chinese military capabilities, might prompt China’s new leadership to crack down on the military’s highly organized team of hackers — or at least urge them to become more subtle.
But Unit 61398, whose well-guarded 12-story white headquarters on the edges of Shanghai became the symbol of Chinese cyberpower, is back in business, according to American officials and security companies.
It is not clear precisely who has been affected by the latest attacks. Mandiant, a private security company that helps companies and government agencies defend themselves from hackers, said the attacks had resumed but would not identify the targets, citing agreements with its clients. But it did say the victims were many of the same ones the unit had attacked before.
The hackers were behind scores of thefts of intellectual property and government documents over the past five years, according to a report by Mandiant in February that was confirmed by American officials. They have stolen product blueprints, manufacturing plans, clinical trial results, pricing documents, negotiation strategies and other proprietary information from more than 100 of Mandiant’s clients, predominantly in the United States.
According to security experts, the cyberunit was responsible for a 2009 attack on the Coca-Cola Company that coincided with its failed attempt to acquire the China Huiyuan Juice Group. In 2011, it attacked RSA, a maker of data security products used by American government agencies and defense contractors, and used the information it collected from that attack to break into the computer systems of Lockheed Martin, the aerospace contractor.
More recently, security experts said, the group took aim at companies with access to the nation’s power grid. Last September, it broke into the Canadian arm of Telvent, now Schneider Electric, which keeps detailed blueprints on more than half the oil and gas pipelines in North America.
Representatives of Coca-Cola and Schneider Electric did not return requests for comment on Sunday. A Lockheed Martin spokesman said the company declined to comment.
In interviews, Obama administration officials said they were not surprised by the resumption of the hacking activity. One senior official said Friday that “this is something we are going to have to come back at time and again with the Chinese leadership,” who, he said, “have to be convinced there is a real cost to this kind of activity.”
Mandiant said that the Chinese hackers had stopped their attacks after they were exposed in February and removed their spying tools from the organizations they had infiltrated. But over the past two months, they have gradually begun attacking the same victims from new servers and have reinserted many of the tools that enable them to seek out data without detection. They are now operating at 60 percent to 70 percent of the level they were working at before, according to a study by Mandiant requested by The New York Times.
The Times hired Mandiant to investigate an attack that originated in China on its news operations last fall. Mandiant is not currently working for The New York Times Company.
Mandiant’s findings match those of Crowdstrike, another security company that has also been tracking the group. Adam Meyers, director of intelligence at Crowdstrike, said that apart from a few minor changes in tactics, it was “business as usual” for the Chinese hackers.
The subject of Chinese attacks is expected to be a central issue in an upcoming visit to China by President Obama’s national security adviser, Thomas Donilon, who has said that dealing with China’s actions in cyberspace is now moving to the center of the complex security and economic relationship between the two countries.
But hopes for progress on the issue are limited. When the Pentagon released its report this month officially identifying the Chinese military as the source of years of attacks, the Chinese Foreign Ministry denied the accusation, and People’s Daily, which reflects the views of the Communist Party, called the United States “the real ‘hacking empire,’ ” saying it “has continued to strengthen its network tools for political subversion against other countries.” Other Chinese organizations and scholars cited American and Israeli cyberattacks on Iran’s nuclear facilities as evidence of American hypocrisy.
At the White House, Caitlin Hayden, the spokeswoman for the National Security Council, said Sunday that “what we have been seeking from China is for it to investigate our concerns and to start a dialogue with us on cyberissues.” She noted that China “agreed last month to start a new working group,” and that the administration hoped to win “longer-term changes in China’s behavior, including by working together to establish norms against the theft of trade secrets and confidential business information.”
In a report to be issued Wednesday, a private task force led by Mr. Obama’s former director of national intelligence, Dennis C. Blair, and his former ambassador to China, Jon M. Huntsman Jr., lays out a series of proposed executive actions and Congressional legislation intended to raise the stakes for China.
“Jawboning alone won’t work,” Mr. Blair said Saturday. “Something has to change China’s calculus.”
The exposure of Unit 61398’s actions, which have long been well known to American intelligence agencies, did not accomplish that task.
One day after Mandiant and the United States government revealed the P.L.A. unit as the culprit behind hundreds of attacks on agencies and companies, the unit began a haphazard cleanup operation, Mandiant said.
Attack tools were unplugged from victims’ systems. Command and control servers went silent. And of the 3,000 technical indicators Mandiant identified in its initial report, only a sliver kept operating. Some of the unit’s most visible operatives, hackers with names like “DOTA,” “SuperHard” and “UglyGorilla,” disappeared, as cybersleuths scoured the Internet for clues to their real identities.
In the case of UglyGorilla, Web sleuths found digital evidence that linked him to a Chinese national named Wang Dong, who kept a blog about his experience as a P.L.A. hacker from 2006 to 2009, in which he lamented his low pay, long hours and instant ramen meals.
But in the weeks that followed, the group picked up where it had left off. From its Shanghai headquarters, the unit’s hackers set up new beachheads from compromised computers all over the world, many of them small Internet service providers and mom-and-pop shops whose owners do not realize that by failing to rigorously apply software patches for known threats, they are enabling state-sponsored espionage.
“They dialed it back for a little while, though other groups that also wear uniforms didn’t even bother to do that,” Kevin Mandia, the chief executive of Mandiant, said in an interview on Friday. “I think you have to view this as the new normal.”
The hackers now use the same malicious software they used to break into the same organizations in the past, only with minor modifications to the code.
While American officials and corporate executives say they are trying to persuade President Xi Jinping’s government that a pattern of theft by the P.L.A. will damage China’s growth prospects — and the willingness of companies to invest in China — their longer-term concern is that China may be trying to establish a new set of rules for Internet commerce, with more censorship and fewer penalties for the theft of intellectual property.
Eric Schmidt, the chairman of Google, said Friday that while there was evidence that inside China many citizens are using the Web to pressure the government to clean up industrial hazards or to complain about corruption, “so far there is no positive data on China’s dealings with the rest of the world” on cyberissues.
Google largely pulled out of China after repeated attacks on its systems in 2009 and 2010, and now has its Chinese operations in Hong Kong. But it remains, Mr. Schmidt said, a constant target for Chinese cyberattackers.
David E. Sanger reported from Washington, and Nicole Perlroth from San Francisco.
A version of this article appeared in print on May 20, 2013, on page A1 of the New York edition with the headline: Chinese Hackers Resume Attacks On U.S. Targets.
美国《纽约时报》前天报道说，土鳖在上海浦东的61398黑客部队在蛰伏三个月后又开始活动了，而且该部队已经升级了其网上攻击的手段。三个月前，61398部队在被美国的网络安全公司Mandiant锁定后停止了网上攻击的活动。但美国人现在在Xi总访美前夕突然又来拿61398部队说事儿，问题不简单呐。
Mandiant声称的位于上海浦东的所谓解放军61398黑客部队大楼：
china hacker head quater in shanghai.jpg (85.03 KB, 下载次数: 0)
下载附件 保存到相册
china hacker head quater in shanghai.？2jpg.jpg (59.19 KB, 下载次数: 0)
下载附件 保存到相册
美国《纽约时报》登载的报道原文的电子版：
http://www.nytimes.com/2013/05/20/world/asia/chinese-hackers-resume-attacks-on-us-targets.html?pagewanted=all&_r=1&
----------------------------
Hackers From China Resume Attacks on U.S. Targets
WASHINGTON — Three months after hackers working for a cyberunit of China’s People’s Liberation Army went silent amid evidence that they had stolen data from scores of American companies and government agencies, they appear to have resumed their attacks using different techniques, according to computer industry security experts and American officials.
The Obama administration had bet that “naming and shaming” the groups, first in industry reports and then in the Pentagon’s own detailed survey of Chinese military capabilities, might prompt China’s new leadership to crack down on the military’s highly organized team of hackers — or at least urge them to become more subtle.
But Unit 61398, whose well-guarded 12-story white headquarters on the edges of Shanghai became the symbol of Chinese cyberpower, is back in business, according to American officials and security companies.
It is not clear precisely who has been affected by the latest attacks. Mandiant, a private security company that helps companies and government agencies defend themselves from hackers, said the attacks had resumed but would not identify the targets, citing agreements with its clients. But it did say the victims were many of the same ones the unit had attacked before.
The hackers were behind scores of thefts of intellectual property and government documents over the past five years, according to a report by Mandiant in February that was confirmed by American officials. They have stolen product blueprints, manufacturing plans, clinical trial results, pricing documents, negotiation strategies and other proprietary information from more than 100 of Mandiant’s clients, predominantly in the United States.
According to security experts, the cyberunit was responsible for a 2009 attack on the Coca-Cola Company that coincided with its failed attempt to acquire the China Huiyuan Juice Group. In 2011, it attacked RSA, a maker of data security products used by American government agencies and defense contractors, and used the information it collected from that attack to break into the computer systems of Lockheed Martin, the aerospace contractor.
More recently, security experts said, the group took aim at companies with access to the nation’s power grid. Last September, it broke into the Canadian arm of Telvent, now Schneider Electric, which keeps detailed blueprints on more than half the oil and gas pipelines in North America.
Representatives of Coca-Cola and Schneider Electric did not return requests for comment on Sunday. A Lockheed Martin spokesman said the company declined to comment.
In interviews, Obama administration officials said they were not surprised by the resumption of the hacking activity. One senior official said Friday that “this is something we are going to have to come back at time and again with the Chinese leadership,” who, he said, “have to be convinced there is a real cost to this kind of activity.”
Mandiant said that the Chinese hackers had stopped their attacks after they were exposed in February and removed their spying tools from the organizations they had infiltrated. But over the past two months, they have gradually begun attacking the same victims from new servers and have reinserted many of the tools that enable them to seek out data without detection. They are now operating at 60 percent to 70 percent of the level they were working at before, according to a study by Mandiant requested by The New York Times.
The Times hired Mandiant to investigate an attack that originated in China on its news operations last fall. Mandiant is not currently working for The New York Times Company.
Mandiant’s findings match those of Crowdstrike, another security company that has also been tracking the group. Adam Meyers, director of intelligence at Crowdstrike, said that apart from a few minor changes in tactics, it was “business as usual” for the Chinese hackers.
The subject of Chinese attacks is expected to be a central issue in an upcoming visit to China by President Obama’s national security adviser, Thomas Donilon, who has said that dealing with China’s actions in cyberspace is now moving to the center of the complex security and economic relationship between the two countries.
But hopes for progress on the issue are limited. When the Pentagon released its report this month officially identifying the Chinese military as the source of years of attacks, the Chinese Foreign Ministry denied the accusation, and People’s Daily, which reflects the views of the Communist Party, called the United States “the real ‘hacking empire,’ ” saying it “has continued to strengthen its network tools for political subversion against other countries.” Other Chinese organizations and scholars cited American and Israeli cyberattacks on Iran’s nuclear facilities as evidence of American hypocrisy.
At the White House, Caitlin Hayden, the spokeswoman for the National Security Council, said Sunday that “what we have been seeking from China is for it to investigate our concerns and to start a dialogue with us on cyberissues.” She noted that China “agreed last month to start a new working group,” and that the administration hoped to win “longer-term changes in China’s behavior, including by working together to establish norms against the theft of trade secrets and confidential business information.”
In a report to be issued Wednesday, a private task force led by Mr. Obama’s former director of national intelligence, Dennis C. Blair, and his former ambassador to China, Jon M. Huntsman Jr., lays out a series of proposed executive actions and Congressional legislation intended to raise the stakes for China.
“Jawboning alone won’t work,” Mr. Blair said Saturday. “Something has to change China’s calculus.”
The exposure of Unit 61398’s actions, which have long been well known to American intelligence agencies, did not accomplish that task.
One day after Mandiant and the United States government revealed the P.L.A. unit as the culprit behind hundreds of attacks on agencies and companies, the unit began a haphazard cleanup operation, Mandiant said.
Attack tools were unplugged from victims’ systems. Command and control servers went silent. And of the 3,000 technical indicators Mandiant identified in its initial report, only a sliver kept operating. Some of the unit’s most visible operatives, hackers with names like “DOTA,” “SuperHard” and “UglyGorilla,” disappeared, as cybersleuths scoured the Internet for clues to their real identities.
In the case of UglyGorilla, Web sleuths found digital evidence that linked him to a Chinese national named Wang Dong, who kept a blog about his experience as a P.L.A. hacker from 2006 to 2009, in which he lamented his low pay, long hours and instant ramen meals.
But in the weeks that followed, the group picked up where it had left off. From its Shanghai headquarters, the unit’s hackers set up new beachheads from compromised computers all over the world, many of them small Internet service providers and mom-and-pop shops whose owners do not realize that by failing to rigorously apply software patches for known threats, they are enabling state-sponsored espionage.
“They dialed it back for a little while, though other groups that also wear uniforms didn’t even bother to do that,” Kevin Mandia, the chief executive of Mandiant, said in an interview on Friday. “I think you have to view this as the new normal.”
The hackers now use the same malicious software they used to break into the same organizations in the past, only with minor modifications to the code.
While American officials and corporate executives say they are trying to persuade President Xi Jinping’s government that a pattern of theft by the P.L.A. will damage China’s growth prospects — and the willingness of companies to invest in China — their longer-term concern is that China may be trying to establish a new set of rules for Internet commerce, with more censorship and fewer penalties for the theft of intellectual property.
Eric Schmidt, the chairman of Google, said Friday that while there was evidence that inside China many citizens are using the Web to pressure the government to clean up industrial hazards or to complain about corruption, “so far there is no positive data on China’s dealings with the rest of the world” on cyberissues.
Google largely pulled out of China after repeated attacks on its systems in 2009 and 2010, and now has its Chinese operations in Hong Kong. But it remains, Mr. Schmidt said, a constant target for Chinese cyberattackers.
David E. Sanger reported from Washington, and Nicole Perlroth from San Francisco.
A version of this article appeared in print on May 20, 2013, on page A1 of the New York edition with the headline: Chinese Hackers Resume Attacks On U.S. Targets.
蓝翔的服务器修好了
蓝翔表示亚历山大
学电脑到蓝翔，试学一月不收费
zjdhn 发表于 2013-5-23 07:08 ![]()
蓝翔的服务器修好了
每天来砸坛子的那位是不是也是蓝翔技校毕业滴？应该不是烹调系的吧？
蓝翔的服务器修好了
每天来砸坛子的那位是不是也是蓝翔技校毕业滴？应该不是烹调系的吧？
浮生半醒 发表于 2013-5-23 14:28 ![]()
学电脑到蓝翔，试学一月不收费
你是说土鳖的信息部队就蓝翔水平吗？
学电脑到蓝翔，试学一月不收费
你是说土鳖的信息部队就蓝翔水平吗？
介个的看蓝翔的课程安排
2013-6-1 16:44 上传
居然黑我大蓝翔~
居然黑我大蓝翔~
蓝翔必定躺枪了每天坐车经过那块的飘过~
看来它们顶上蓝翔了。
阿拉大魔都大同路v5878k14啊。。。
七院后面，谢谢
要到学员毕业考核了？原来黑客攻击行动还必须要在一个统一集中固定的大厦里进行啊
不给蓝翔做广告了？蓝翔拒付广告费？
我以为是蓝翔
这里被偷那里被盗，美利坚的网络部队是吃屎的吗？负责人不用撤职？
解散了得了，浪费纳税人的钱。
这里被偷那里被盗，美利坚的网络部队是吃屎的吗？负责人不用撤职？
解散了得了，浪费纳税人的钱。每天坐车经过那块的飘过~
小心战斧！蓝翔是解放军一条龙的训练基地。网战，后勤厨师，后勤物流，占领后维持治安，强拆等。学电脑，学厨师，挖掘机，装载机，叉车
小心战斧！蓝翔是解放军一条龙的训练基地。网战，后勤厨师，后勤物流，占领后维持治安，强拆等。学电脑，学厨师，挖掘机，装载机，叉车
全美第一大报纸又开始忽悠这个事了啊
tudoubocai 发表于 2013-6-1 19:07 ![]()
小心战斧！蓝翔是解放军一条龙的训练基地。网战，后勤厨师，后勤物流，占领后维持治安，强拆等。学电脑， ...
有没有红翔基地啊？
小心战斧！蓝翔是解放军一条龙的训练基地。网战，后勤厨师，后勤物流，占领后维持治安，强拆等。学电脑， ...
有没有红翔基地啊？
tudoubocai 发表于 2013-6-1 19:07 ![]()
小心战斧！蓝翔是解放军一条龙的训练基地。网战，后勤厨师，后勤物流，占领后维持治安，强拆等。学电脑， ...
貌似还有化妆侦察啥的
小心战斧！蓝翔是解放军一条龙的训练基地。网战，后勤厨师，后勤物流，占领后维持治安，强拆等。学电脑， ...
貌似还有化妆侦察啥的
贼喊捉贼啊
黑客攻击的时候也用语聊吗？
有没有红翔基地啊？
红翔是有痔疮，要治
红翔是有痔疮，要治
蓝翔网站又要被黑了。
lgn12 发表于 2013-6-1 16:45 ![]()
居然黑我大蓝翔~
我差点被吓出翔了
居然黑我大蓝翔~
我差点被吓出翔了反正要保证兔子各种中枪。。。
明显是新一轮的蓝翔招生季到了 纽约时报在做软性广告
换一个地方嘛
这方言说啥？
蓝翔开始毕业实习了?
别把网军说得太厉害，像这样的单位网络都是物理隔离的，大部分的泄密都是内部人员外涉的
互联网的根服务器都在美国人手里，中国网军几十存在，对美国佬有什么威胁？胡吹也就是蒙骗些不懂的外行人。
换一个地方嘛
换哪里还能跑的了我大蓝翔？
换哪里还能跑的了我大蓝翔？
连番号都有。。。这不是极强的内幕就是无敌的脑补。。。allenma44 发表于 2013-6-1 21:05 ![]()
红翔是有痔疮，要治
额，虽然很恶心，但我居然笑喷了。。真的笑喷了。。。。
红翔是有痔疮，要治
额，虽然很恶心，但我居然笑喷了。。真的笑喷了。。。。
这个很正常啊，快中考高考了，蓝翔要开始招生了。
蓝领扩招到上海了？
红翔是有痔疮，要治
我去，这个……能不能不要让人笑喷
我去，这个……能不能不要让人笑喷