Chinese Hackers’ Evolution from Vandals to Strategists

Chinese nation-state hackers share tools. Their techniques overlap. Observers of the Sino hacking scene can trace a web of intersecting contractors and businesses that underpin campaigns such as the hacking of U.S. telecoms by Salt Typhoon.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

There may be an even more fundamental reason why Beijing-linked cyber operations show recurring patterns: a group of 40 hackers who came up together in the “patriotic hacking” scene in the late 1990s and early 2000s, “whose leadership, technical skills and entrepreneurial ventures had a lasting impact on China’s cybersecurity ecosystem,” posits a study from Eugenio Benincasa, a senior security researcher at ETH Zurich.

Members of the “Red 40” – their ranks today include executives at major Chinese tech firms and founders of cybersecurity startups – disproportionately come from three grassroots hacking groups that, at the turn of the century, sought digital revenge against Western targets, mostly through website defacements and denial-of-service attacks. The groups are Green Army, Xfocus and 0x557.

Some of Red 40 have built startups in areas such as advanced detection and cybercrime intelligence, such as Nanjing Hanhaiyuan, known as “China’s FireEye,” Anluo Technology, Tencent Xuanwu Lab and Yunding Labs, which went on to win international hacking contests.

Among the alumni of those groups is former Green Army member Zhou Shuai, aka “Coldface,” indicted by the U.S. Department of Justice in March for his role in Silk Typhoon, responsible for a late 2024 incursion into the Department of Treasury (see: US Seizes Chinese Hacker Infrastructure, Unseals Indictments).

Green Army veterans also went on to found private hacking firms iSoon and Integrity Tech. A likely disgruntled iSoon employee in February 2024 leaked internal documents, unintentionally setting off a wave of revelations about Chinese Ministry of State Security reliance on private sector businesses to do the actual work of hacking foreign networks for intelligence. Wu Haibo, aka Shutdown, an iSoon operator and Red 40 member, was indicted by the U.S. in March (see: US Prosecutors Indict iSoon Chinese Hacking Contractors).

The interchange of shared capabilities and recurring malware such as PlugX in Chinese hacking campaigns has led Western researchers to propose a “digital quartermaster” theory – that a central organization within the Chinese government distributes cyber exploits to multiple cyberespionage hacking groups.

Benincasa told Information Security Media Group his research of an influential cadre of hackers who continue to this day to swap talent, tools and operational capabilities is compatible with the theorized digital quartermaster.

“The overlaps we observe stem partly from informal connections, such as those among Red 40 members involved in state-sponsored cyber operations, but also from more top-down mechanisms – especially in vulnerability sharing, where it’s highly likely that the government plays a coordinating role in distributing vulnerabilities across hacking groups and contractors,” he said.

Tools developed for personal or research use by Red 40 hackers such as a proxy connection tool called Htran and X-Scan, a popular vulnerability scanner, have been used in Chinese nation-state hacking.

Similarly, PlugX and ShadowPad, created by Tan Dailin and Zhou Jibing, have been spotted in attacks by Chinese nation-state activity tracked as APT3, APT41, GALLIUM and Winnti. iSoon is among the hacking contractors found deploying PlugX and ShadowPad for espionage campaigns targeting ethnic minorities in Asia (see: iSoon Leak Shows Links to Chinese APT Groups).

“China’s experience offers valuable insights into how decentralized cyber collectives can evolve into institutionalized assets,” Benincasa said. “The Red 40 didn’t merely staff China’s cybersecurity ecosystem; they shaped it from the ground up.”