The Evolution of China’s ‘Honkers’ from Patriotic Hackers to State-Sponsored Cyberspies

In the early 2000s, a group of Chinese hackers known as the Honkers began launching patriotic cyberattacks against Western targets. Initially, these attacks were simple website defacements and denial-of-service operations, driven by national pride. However, as their skills grew, so did their involvement with the Chinese government. Some, like Tan Dailin, transitioned from hacking as a hobbyist to becoming key members of China’s state-sponsored hacking groups, including the notorious APT 41. Many former Honkers played vital roles in advancing China’s cyber-espionage capabilities. Some were recruited directly by the People’s Liberation Army (PLA) or the Ministry of State Security (MSS), while others shifted to launching cybersecurity firms that provided tools to the Chinese government. The Honkers’ evolution reflects China’s strategy of co-opting skilled individuals for its intelligence network. Over time, many of these hackers became integral to China’s cyber espionage efforts, targeting both government systems and private organizations around the world. Despite their early patriotic motivations, many of these hackers eventually found themselves participating in sophisticated state-sponsored cyberattacks, often for financial compensation.