Possibly. There are quite a lot more addresses than two. From page 40:
Over a two-year period (January 2011 to
January 2013) we confirmed 1,905 instances of APT1 actors logging into their hop infrastructure from 832 different
IP addresses with Remote Desktop... Of the 832 IP addresses, 817 (98.2%) were Chinese and belong predominantly to four large net blocks in Shanghai which we will refer to as APT1’s home networks.
Actually their conclusion is not that straightforward:
Either a secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based
telecommunications infrastructure is engaged in a multi-year, enterprise scale computer espionage campaign
right outside of Unit 61398’s gates, performing tasks similar to Unit 61398’s known mission.
Or APT1 is Unit 61398.
I don't have any idea of how much of this can be taken for its face value though, as they don't share much of how they have gathered the information in the report. And granted, Shanghai is a big place.
1) expect to find a lot of PLA spooks in that location
2) expect to find that any China related hackers have their address there, because that's the last point that they can change their IP address before the packets head over to the US
Doesn't mean that the two groups are connected....
One thing that surprised me looking in this is how most internet traffic goes through a very few links. There are only two major connection points between the US and China and the neighorhood with the IP blocks hosts one of them.
In particular, if you the hackers were physically located in Beijing, I'd bet that the packets would look like they came from that part of Pudong.
Over a two-year period (January 2011 to January 2013) we confirmed 1,905 instances of APT1 actors logging into their hop infrastructure from 832 different IP addresses with Remote Desktop... Of the 832 IP addresses, 817 (98.2%) were Chinese and belong predominantly to four large net blocks in Shanghai which we will refer to as APT1’s home networks.
Actually their conclusion is not that straightforward:
Either a secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multi-year, enterprise scale computer espionage campaign right outside of Unit 61398’s gates, performing tasks similar to Unit 61398’s known mission.
Or APT1 is Unit 61398.
I don't have any idea of how much of this can be taken for its face value though, as they don't share much of how they have gathered the information in the report. And granted, Shanghai is a big place.