Over a two-year period (January 2011 to January 2013) we confirmed 1,905 instances of APT1 actors logging into their hop infrastructure from 832 different IP addresses with Remote Desktop... Of the 832 IP addresses, 817 (98.2%) were Chinese and belong predominantly to four large net blocks in Shanghai which we will refer to as APT1’s home networks.
Actually their conclusion is not that straightforward:
Either a secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multi-year, enterprise scale computer espionage campaign right outside of Unit 61398’s gates, performing tasks similar to Unit 61398’s known mission.
Or APT1 is Unit 61398.
I don't have any idea of how much of this can be taken for its face value though, as they don't share much of how they have gathered the information in the report. And granted, Shanghai is a big place.
http://en.wikipedia.org/wiki/TPE_%28cable_system%29
In other words, you'd
1) expect to find a lot of PLA spooks in that location 2) expect to find that any China related hackers have their address there, because that's the last point that they can change their IP address before the packets head over to the US
Doesn't mean that the two groups are connected....
One thing that surprised me looking in this is how most internet traffic goes through a very few links. There are only two major connection points between the US and China and the neighorhood with the IP blocks hosts one of them.
In particular, if you the hackers were physically located in Beijing, I'd bet that the packets would look like they came from that part of Pudong.
They essentially find 2 IP addresses that can be traced back to a region of Shanghai with millions of people, and because one particular building that's been known to house Unit 61398 is within this broad geographic area, they make the conclusion that Unit 61398 is involved, which is a key foundation of the report.
Am I missing something?