The Emergence of China's Elite Cyber Espionage Agents

During the early 2000s, Tan Dailin, then a graduate student at Sichuan University of Science and Engineering, drew the Chinese People's Liberation Army's attention.

Tan belonged to a growing collective known as the Honkers. This group of young Chinese patriots formed organizations like the Green Army in response to perceived Western insults to China. Their early attacks, mainly consisting of simplistic website defacements and service interruptions, targeted the US, Taiwan, and Japan. As their skills improved, Tan chronicled these activities in online posts, attracting the PLA's interest after targeting Japanese entities.

Encouraged by this attention, Tan and his colleagues participated in a PLA-associated hacking competition, earning top honors. Subsequently, they attended a rigorous training program, where they developed advanced hacking tools and honed their infiltration techniques.

Details of Tan's story are somewhat opaque thereafter. Adopting the aliases 'Wicked Rose' and 'Withered Rose,' he established the Network Crack Program Hacker (NCPH), gaining fame through hacking contests and tool creation. Among their creations was the GinWui rootkit, a significant early remote-access backdoor from China. Experts suggest NCPH used this and other exploits to infiltrate American corporations and government systems, acting under the PLA's auspices, as per Adam Kozy, an ex-FBI analyst tracking Chinese cyber operations.

At the time, Tan disclosed online that his hacking efforts earned him $250 monthly, without revealing his sponsors. A later report suggested his compensation rose to $1,000 after a prolific hacking period in 2006.

Ultimately, Tan transitioned to a consultancy role for the Ministry of State Security, aligning with the infamous hacking group APT 41. By 2020, he faced charges in the US for cyber intrusions impacting over 100 targets, including government agencies and businesses.

Tan's trajectory from a patriotic hacker to a state operative is mirrored by other Honkers, individuals whose initial self-motivated cyber activities were later leveraged by China for espionage.

Although extensive documentation on the Honkers is scarce, Adam Kozy highlighted their significance in a 2022 presentation. A recent study by Eugenio Benincasa expands on this, detailing the evolution of these cyber enthusiasts into influential components of China's espionage framework.

The Honkers' Cultural Identity and Evolution

The Honker community originated as China embraced the internet in 1994, initially among university students immersed in online discussions about programming and cybersecurity. They coalesced into groups like Xfocus and the Honker Union of China, nicknamed 'Red Hackers' due to their patriotic ethos and the color red's significance in China.

These groups operated under a loosely structured, ethical framework, influenced by figures like Lin Zhenglong, who advocated for using hacking skills to bolster security. Despite hacking being somewhat tolerated, guidelines urged avoiding governmental networks and minimizing damage.

However, this ethos shifted following international events that kindled nationalistic fervor—prompting retaliatory cyber actions against entities in Indonesia, Taiwan, and Japan. These acts fostered a sense of unity and purpose distinct from their Western counterparts, focused on serving national interests.

With no state directives evident, the Honkers nonetheless aligned their actions with government interests, garnering public approval for their perceived patriotism. This stance began shifting with incidents like the 2001 Hainan collision, as government concerns over potential diplomatic effects and calls for tighter cyber control emerged.

From Enthusiasts to State Assets

The subsequent crackdown fractured the Honker community. Some pursued legitimate cybersecurity careers in prominent firms like Baidu or Alibaba, while others migrated to state-directed espionage.

Many former Honkers' careers have been spotlighted through leaks and US legal actions, revealing their continued involvement in state-sponsored hacking and the commercialization of espionage ventures.

Like their US counterparts who transitioned from hacking to legal cybersecurity roles, the Honkers' story highlights a key distinction. China's intelligence authorities actively integrated its cyber talent into national operations, driven by both patriotic motivations and financial incentives.

Kozy notes that China's strategic co-option of these individuals centered on their nationalistic inclinations, ensuring their contributions to the country while offering lucrative benefits. The transformation from individual hackers to influential espionage assets underscores their integral role in the state’s comprehensive surveillance strategy.