China’s Cyber Spies: The Rise of ‘Patriotic Honkers
From Hacktivism to state Espionage: China’s Evolving Cyber Warfare Landscape
Table of Contents
The Genesis of Chinese APTs: from Honker Union to Complex Operations
The landscape of Chinese cyber operations has undergone a dramatic transformation, evolving from early hacktivist roots to sophisticated, state-sponsored espionage campaigns. At the heart of this evolution lie groups like the Honker Union, whose early innovations laid the groundwork for the advanced persistent threats (APTs) that continue to shape global cybersecurity concerns.
the Honker Union’s Legacy: Tools of Deception and Backdoors
In 2003, two members of the Honker Union, a prominent Chinese hacktivist collective, released HTRAN. This groundbreaking tool was designed to mask an attacker’s true location by rerouting thier internet traffic through proxy servers, a technique that has since become a staple for Chinese APTs seeking to conceal their origins.
The influence of the Honker Union extends beyond traffic obfuscation. Tan, a key figure from the group, along with Zhou Jibing (whg), another NCPH member, are widely believed to have developed the PlugX backdoor in 2008. PlugX, a highly versatile and persistent piece of malware, has been deployed by over ten diffrent Chinese APT groups, underscoring its importance in their cyber arsenal.Further growth by Zhou, as noted by benincasa, led to the creation of ShadowPad, a sophisticated backdoor that has been utilized by prominent groups such as APT 41 and others.
The Commercialization of Cyber Espionage: for-Profit Firms and State Collusion
The transition from hacktivism to state-sponsored operations is further exemplified by the emergence of for-profit cybersecurity firms founded by former members of these early hacking groups. Leaks and US indictments against former Honkers have shed light on their alleged post-Honker careers, revealing a pattern of leveraging their skills for state-sanctioned hacking operations through private companies.
i-Soon and Integrity Tech: From Hackers to Contractors
Wu Haibo (shutdown), formerly associated with Green Army and 0x557, launched i-Soon in 2010. This company has been implicated in extensive espionage activities on behalf of China’s Ministry of State Security (MSS) and Ministry of Public Security (MPS). Last year, a important leak of internal i-Soon files and chat logs exposed the company’s direct involvement in espionage. In March of this year, the US indicted eight i-Soon employees and two MPS officers for their roles in hacking operations targeting US government agencies, Asian foreign ministries, dissidents, and media outlets.
Similarly, Integrity Tech, founded in 2010 by Cai Jingjing (cbird), a former Green army member, was sanctioned by the US this year due to its involvement in global infrastructure hacks.
indictments and Sanctions: Unraveling the Network
The US has continued to pursue individuals and entities involved in these operations. This year, former Green Army members Zhou and Wu were indicted for conducting state hacking operations. Zhou, in particular, was sanctioned for his links to APT 27.Beyond state-sponsored hacking, Zhou is also alleged to have operated a data-leak service, selling stolen data to various customers, including intelligence agencies.
A “Whole-of-Society” Approach: China’s State-Compelled Cyber Espionage
The trajectory of Chinese hackers mirrors, in some ways, the early careers of US hackers who transitioned into cybersecurity founders and were subsequently recruited by intelligence agencies. However, a key distinction lies in China’s approach. as Kozy points out, China’s “whole-of-society” intelligence apparatus has actively compelled citizens and companies to collaborate with the state in conducting espionage.
“I think that China from the beginning just thought, ‘We can co-opt [the Honkers] for state interests,'” Kozy states. This strategy capitalized on the patriotic leanings of many young hackers, who were persuaded to contribute to national interests. Furthermore, the prospect of financial gain also played a significant role, as many realized the lucrative potential of their skills when aligned with state objectives. This symbiotic relationship between the state and skilled individuals has fueled China’s formidable cyber espionage capabilities, presenting a complex and evolving challenge to global cybersecurity.