A look at China's evolving approach to state-sponsored hacking, which borrows from Russia and Iran and increasingly relies on private sector hackers
The state security ministry is recruiting from a vast pool of private-sector hackers who often have their own agendas and sometimes use … Tweets: @bhweingarten , @alfonslopeztena , @timothys , @aadilbrar , @paulmozur , @paulmozur , @paulmozur , @paulmozur , @paulmozur , @nytimesbusiness , and @paulmozur Tweets: Benjamin Weingarten / @bhweingarten : “Chinese hackers have become increasingly aggressive. The rate of global attacks linked to the Chinese government has nearly tripled since last year compared with the four previous years” https://www.nytimes.com/... @alfonslopeztena : A new group of hackers for hire has made China's state cyberspying machine stronger, more sophisticated and — for its growing array of government and private-sector targets — more dangerously unpredictable, blending espionage and entrepreneurship https://www.nytimes.com/... Tim Shorrock / @timothys : I don't know, maybe I should copyright this title.😂 “Spies for Hire: China's New Breed of Hackers Blends Espionage and Entrepreneurship.” https://www.nytimes.com/... Aadil Brar / @aadilbrar : “China's premier spy agency is increasingly reaching beyond its own ranks to recruit from a vast pool of private-sector talent” https://www.nytimes.com/... @paulmozur : The mysterious website Intrusion Truth ( https://intrusiontruth.wordpress.com/ ), which has repeatedly pre-empted US investigators in naming those behind MSS hacking circles went deeper. It found and published QQ and Renren photos of MSS officers. https://twitter.com/... @paulmozur : Our look at how China's spies are turning to the private sector to hire hackers, often in plain sight. The shift has fed a new onslaught of attacks, but also impacted discipline, with more hackers committing cybercrime on the side for pocket change. https://www.nytimes.com/... @paulmozur : The professor, mentioned in the indictment but not charged, has run a site that offers bounties to students and others who can crack certain passwords in novel ways. He also put together a computer security competition that would eventually go province wide. https://twitter.com/... @paulmozur : In another ad on Sichuan University's recruiting page, the same shell company offered salaries of $1200-$300 w/ $15k bonuses for “penetration testing engineers” with experience “sharing malware exploits.” Basically people who think out and keep up on how to break into computers. https://twitter.com/... @paulmozur : Often China's Ministry of State Security will use shell companies to hire linguists and promising hackers. Here's an example, a shell company named in a US indictment looks in 2018 for Cambodian linguists months before breaking into Cambodian computers ahead of an election: https://twitter.com/... @nytimesbusiness : A new group of hackers has made China's state cyberspying machine stronger, more sophisticated and — for its growing array of government and private-sector targets — more dangerously unpredictable. https://www.nytimes.com/... @paulmozur : The pattern that emerges is a proliferating campaign to bring private sector and university talent to aid a massive cyber offensive that has stolen IP, ransomed corp computers, and taken reams of private data. It's unlikely to stop soon and may be growing more reckless. https://twitter.com/...
Context & Ripple Effects
The Ministry of State Security's takeover of China's hacking operations in 2015 set the stage for today's model: rather than running everything in-house, the ministry taps a vast pool of private-sector hackers who often have agendas of their own. That shift followed an earlier one documented by researchers, when [[a:947083|state-sponsored attackers pivoted toward increasingly sophisticated campaigns against ethnic minorities]].
The result is a hybrid workforce that blends espionage and entrepreneurship — a structure later coverage has kept confirming, from APT40 using shell companies to recruit linguists to the patriotic Honkers community becoming part of the espionage apparatus.
First-order effects
- Targets now face operators whose motives mix state intelligence-gathering with personal profit — IP theft, ransomware against corporate machines, and data exfiltration can come from the same recruited pool.
- Private-sector hackers gain a state-backed revenue channel while retaining outside clients, so activity attributed to 'the Chinese government' nearly tripled versus prior years.
Second-order effects
- Western defenders and attribution researchers like Intrusion Truth must distinguish state tasking from freelance cybercrime riding on state infrastructure, complicating indictments and sanctions that assume a clean chain of command.
- Rival states already running similar models — the Russian and Iranian playbooks China borrowed — face competitive pressure to deepen their own contractor ecosystems as China scales recruitment through shell companies and front firms.
Third-order effects
- If the pattern holds, offensive cyber becomes a gray-market industry where espionage, crime, and patriotism are indistinguishable, eroding the legal and diplomatic frameworks built around attributing attacks to identifiable state units.
- Talent pipelines like university programs and self-taught communities become strategic assets that governments cultivate directly, turning national security into a labor-market competition for hackers.
The trend: Major powers are shifting offensive cyber operations from uniformed state units to loosely governed pools of entrepreneurial hackers, borrowing each other's deniability models.