PLA Unit 61398

People's Liberation Army Unit 61398
61398部队
Emblem of the People's Liberation Army
Active2014-Present
Country China
Allegiance Chinese Communist Party
BranchPeople's Liberation Army Cyberspace Force
TypeCyber force, Cyber-espionage Unit
RoleCyber warfare
Electronic warfare
Part of People's Liberation Army
Garrison/HQTonggang Road, Pudong, Shanghai
Nickname(s)
  • APT 1
  • Comment Crew
  • Comment Panda
  • GIF89a
  • Byzantine Candor
  • Group 3
  • Threat Group 8223
Engagements

PLA Unit 61398 (also known as APT1, Comment Crew, Comment Panda, GIF89a, or Byzantine Candor; Chinese: 61398部队, Pinyin: 61398 bùduì) is the Military Unit Cover Designator (MUCD)[1] of a People's Liberation Army advanced persistent threat unit that has been alleged to be a source of Chinese computer hacking attacks.[2][3][4] The unit is stationed in Pudong, Shanghai,[5] and has been cited by US intelligence agencies since 2002.

  1. ^ "APT1: Exposing One of China's Cyber Espionage Units" (PDF). Mandiant. Archived (PDF) from the original on 19 February 2013. Retrieved 19 February 2013.
  2. ^ Sanger, David E.; Barboza, David; Perlroth, Nicole (19 February 2013). "Chinese Army Unit Is Seen as Tied to Hacking Against U.S." The New York Times. ISSN 0362-4331. Archived from the original on 19 February 2013. Retrieved 28 May 2023.
  3. ^ "Chinese military unit behind 'prolific and sustained hacking'". The Guardian. 19 February 2013. Archived from the original on 20 December 2013. Retrieved 19 February 2013.
  4. ^ Cite error: The named reference :0 was invoked but never defined (see the help page).
  5. ^ "中国人民解放军61398部队招收定向研究生的通知" [A notification of PLA Unit 64398 to recruit postgraduate students as PLA-funded scholarship student.]. Zhejiang University. 13 May 2004. Archived from the original on 2 December 2016. Retrieved 5 January 2019.