WASHINGTON — A private technology security firm on Tuesday described in detail efforts it blamed on a Chinese military unit to hack 141 businesses, mostly inside the United States, and steal commercial secrets. China denies the claim.
What is Mandiant?
Headquartered in Alexandria, Va., Mandiant was started in 2004 by Kevin Mandia, a retired Air Force officer who carved out a lucrative niche investigating computer crimes. Mandiant says it can detect and trace even quiet intrusions, such as the theft of employee passwords or trade secrets that a company otherwise might not be aware is happening.
Mandiant was most recently noted for its work in helping The New York Times trace an attack on its employees' computers to China on the heels of a Times investigation into China's Premier Wen Jiabao. The newspaper publicly acknowledged Mandiant's role in the case.
Are there similar firms?
There are other companies that specialize in cybercrime response and forensics, including CrowdStrike, Kroll Advisory Solutions and Stroz Friedberg in New York. Others specialize in establishing and testing a company's computer defenses and monitoring traffic to detect hackers or suspicious behavior.
Companies can be reluctant to call the FBI. Businesses don't want to hand over their most sensitive information — including computers and proprietary data — to the government and would rather maintain control of the investigation. Many companies are less concerned about tracing the origin of an attack than resuming business.
What did Mandiant's report say?
Mandiant alleges that it has traced a huge hacking campaign on U.S. businesses to a drab, white 12-story office building outside Shanghai run by “Unit 61398” of the People's Liberation Army. The report includes some of the most extensive and detailed accusations on China's cybersnooping publicly available, including a timeline and details of malware used.
The U.S. government, including its intelligence agencies, almost certainly has similar and even more detailed information but it's regarded as highly classified. Being a private company, Mandiant doesn't have to keep its information secret, although it hasn't released the names of the companies attacked.
