6 No Doubt to Hack You, Writed by UglyGorilla: China's PLA Unit 61398 and Economic Espionage

On February 8, 2010, twenty employees of U.S. Steel received an email from the company's Chief Executive Officer, John Surma. The subject line read “Meeting Invitation,” and the agenda for the proposed meeting was also included as an attachment, in a file titled simply “agenda.zip.” It was not until long after several of the recipients had opened the attachment and installed the contents on their computers that anyone realized the message had not, in fact, been sent by Surma, but instead by Sun Kailiang, an officer in China's People's Liberation Army (PLA) Unit 61398, the branch of the PLA responsible for conducting cyber operations and signals intelligence from a twelve-story building on Datong Road in the Pudong District of Shanghai.
1
In 2010, few civilians in the United States had heard of PLA Unit 61398, but U.S. Steel's IT staff noticed several suspicious emails on their systems—the “Meeting Invitation” was only one of roughly fifty phishing messages that Sun sent during February 2010 to U.S. Steel employees, ostensibly from the company's own high-level executives. Many of those emails featured subject lines like “U.S. Steel Industry Outlook” and included links or attachments that, like the agenda.zip file, installed malware on the recipients' computers when clicked.
2