By   Eugenio Benincasa

Recent revelations of Chinese government-backed hacking show a recurring pattern: prominent hackers behind groups such as APT17, APT27, APT41, Flax Typhoon, and Red Hotel—monikers given by cybersecurity researchers for groups with similar tactics—trace their roots to a broader community of early elite hackers, known as “red hackers” or “Honkers” (红客, Hong Ke). Active in online forums during the mid-1990s and 2000s, these hackers operated independently but often aligned with state interests, targeting foreign entities perceived as hostile to China, including the US, Taiwan, and Japan. The author’s analysis builds upon prior research into China’s red hacker groups.

Center for Security Studies (CSS), ETH Zürich . 2025. 74p.