How the Chinese hacking community Honkers, consisting of patriotic self-taught tech enthusiasts, became an integral part of China's cyberespionage apparatus
A new report traces the history of the early wave of Chinese hackers who became the backbone of the state's espionage apparatus. Bluesky: @patrickhowelloneill.com . Mastodon: @kimzetter@infosec.exchange . X: @kimzetter Bluesky: Patrick Howell O'Neill / @patrickhowelloneill.com : Anyone interested in diving down this rabbit hole should read The Dark Visitor by Scott Henderson which, when I first read it, was a total education on the Chinese patriotic hackers of 20 years ago and how they're connected to the modern day. It's old at this point but remains a valuable resource. … Mastodon: Kim Zetter / @kimzetter@infosec.exchange : China's APT cyberspies are some of the best in the business. But how did the hackers get their start? Turns out many were “Honkers” - patriotic hackers in their teens and 20s who, in the late 90s, launched nationalistic cyberattacks against countries they deemed disrespectful to China. … X: Kim Zetter / @kimzetter : How did China's top APT hackers come to be? Many were early “Honkers” - patriotic hackers in late 90s who launched low-skill cyberattacks against nations deemed disrespectful to China. But once Honkers developed their skills, PLA/MSS recruited them. https://www.wired.com/...
Context & Ripple Effects
The account supplies a historical bridge between early patriotic hacking circles and the state organizations that later carried out cyberespionage. It adds personnel and network origins to earlier reporting that connected Chinese hacking activity to military staff. earlier reporting tied activity to a Chinese military staffer
Related coverage shows the apparatus evolving beyond a single institutional model: China increasingly drew on private-sector hackers, while leaked material exposed the operational weaknesses of contractor I-Soon. China's expanding reliance on private-sector hackers and the I-Soon contractor leak make the Honkers' pathway an important precursor rather than an isolated episode.
First-order effects
- The report strengthens the case that Honkers' skills and social networks were absorbed by the PLA and MSS, reframing an ostensibly informal patriotic scene as a source of state cyberespionage capacity.
- It gives analysts a clearer lineage for Chinese APT organizations, linking their roots to recruitment and integration rather than treating them solely as stand-alone state units.
Second-order effects
- Defenders and attribution researchers have reason to examine talent networks, patriotic communities, and contractors alongside formal government structures when assessing Chinese-linked activity.
- The history makes later use of private hacking suppliers look less like a break from state control than an extension of a longer pattern of drawing civilian technical capacity into espionage work.
Third-order effects
- If this recruitment-and-integration model persists, the boundary between nationalist online communities, commercial suppliers, and state espionage will remain difficult to draw—and difficult for outside observers to deter through measures aimed only at official agencies.
- The broader structural shift is toward cyber capability built through an ecosystem of state and non-state participants, where organizational labels may reveal less than the pathways through which skills and access are mobilized.
The trend: This is one data point in the long-term institutionalization of civilian technical networks into China's state cyberespionage ecosystem.