In recent years, China’s hackers have transformed from clumsy cyber thieves into highly sophisticated digital warriors, now considered one of the most formidable forces in global cyber warfare. These individuals, once primarily focused on stealing corporate secrets and consumer data, have evolved into key players in China’s military strategy, targeting critical infrastructure and communication networks in the United States. But where did these hackers come from, how were they recruited, and what does their involvement mean for future geopolitical conflicts?
The Origins: Who Are These Hackers?
Before becoming cyber soldiers for the Chinese state, many of these hackers were university students, freelance programmers, or members of nationalist hacking groups like the Honker Union. This group gained prominence in the late 1990s, driven by patriotic fervor after events like the U.S. bombing of the Chinese embassy in Belgrade. These young hackers often worked independently or in loose collectives, honing their skills through small-scale cyberattacks and online competitions.
As Greg Walton, a researcher specializing in China’s cyber activities, noted, the Chinese government has been able to use groups like the Honker Union as a “proxy force” when their political goals aligned with the group’s nationalist sentiment. Over time, the most talented and committed individuals were funneled into more formal roles under state sponsorship.
Recruitment: A Blend of Patriotism, Talent, and Incentives
The recruitment of China’s top cyber talent is a multi-pronged effort, blending nationalism, career incentives, and state-backed programs. Universities like Northwestern Polytechnical University—overseen by the People’s Liberation Army (PLA)—are key hubs for cultivating hacking talent. Capture-the-flag (CTF) hacking competitions, such as the Zhujian Cup, serve as proving grounds where participants demonstrate their skills in live scenarios.
Interestingly, some competitions appear to go beyond simulated exercises. Participants are often asked to sign non-disclosure agreements and delete any digital footprints after the contest ends. One pledge required competitors to agree: “I promise that if any information disclosure incident (or case) occurs due to personal reasons, causing loss or harm to the organizer and the country, I, as an individual, will bear legal responsibility in accordance with the relevant laws and regulations.”
Winners of these competitions are funneled into military programs or elite cyber units like PLA Unit 61486 and 61398, which focus on cyber espionage and infrastructure sabotage. Dakota Cary, a cyber intelligence analyst, remarked that these competitions are not just about skill development: “If it’s a real CTF exercise, why are [participants] deleting data and … backdoors?”
Additionally, China’s Thousand Talents Plan, originally designed to recruit global scientific talent, has also been leveraged to bring foreign-trained cyber experts back into the fold. These individuals are offered substantial financial incentives, prestigious academic titles, and access to high-end research facilities.
The Training Grounds: Universities and Military Units
Key academic institutions, including Shanghai Jiao Tong University and Harbin Institute of Technology, act as talent incubators. Cybersecurity majors are heavily emphasized, and students are encouraged to participate in state-sponsored competitions. From there, the most promising hackers are absorbed into PLA cyber units.
- PLA Unit 61398: Known for intellectual property theft and cyber espionage.
- PLA Unit 61486 (Putter Panda): Specializes in space and satellite technology intrusions.
- Salt Typhoon & Volt Typhoon: Groups responsible for infiltrating U.S. telecom networks and critical infrastructure.
CrowdStrike, a cybersecurity firm that investigated Unit 61486, discovered that its members often used phishing emails disguised as conference invitations or brochures to install malware. Dmitri Alperovitch, CrowdStrike’s CTO, explained: “It certainly looks like one of the actors we track out of China that we’ve seen going after aircraft manufacturers in the past.”
How Many Are There?
Estimates suggest China has recruited over 300,000 hackers through competitions, academic programs, and military units. However, this number likely underestimates the total cyber force, given the decentralized nature of cyber operations and the constant influx of new talent.
According to researchers Cary and Benincasa, “More than 540 capture-the-flag rounds of competition have occurred in China since 2004… About 300,000 people have participated in the contests over the last decade.”
What Do They Do Now?
These hackers are no longer just stealing blueprints for fighter jets or pharmaceutical formulas. They are embedding themselves in critical U.S. infrastructure, including ports, water utilities, and telecommunications networks.
For instance:
- Volt Typhoon infiltrated water utilities in Hawaii and oil facilities in Texas, studying their emergency response systems.
- Salt Typhoon accessed sensitive telecom data, including wiretaps and communications from senior government officials.
These activities suggest a long-term strategy: prepare for potential conflict by laying digital traps that could disrupt American military supply lines, scramble air traffic, and cause widespread panic.
Anne Neuberger, President Biden’s deputy national security adviser for cybersecurity, noted: “They were very careful about their techniques. In some cases hackers erased cybersecurity logs, and in others the victim companies didn’t keep adequate logs, meaning there were details ‘we will never know regarding the scope and scale of this.’”
The Global Threat Landscape
The rise of China’s state-backed hacker force signifies a shift in how wars might be fought in the future. Digital battlegrounds are no longer science fiction—they are a present reality. As U.S. officials scramble to patch vulnerabilities and fortify digital defenses, China’s cyber operatives continue to grow in number and skill.
Senator Dan Sullivan said during a congressional hearing: “It’s shocking how exposed we are, and still are.”
A Digital Cold War?
China’s transformation of amateur hackers into state-sponsored cyber soldiers represents one of the most significant developments in modern warfare. Through universities, competitions, and strategic recruitment programs, China has built an army capable of infiltrating and disrupting critical infrastructure across the globe. The question now is not whether these hackers will act in the event of conflict—but when. As George Barnes, former deputy director of the NSA, chillingly stated: “After Taiwan itself, the U.S. would be target zero for disruptive cyberattacks in the event of a conflict over the island.”
Did a Chinese University Hacking Competition Target a Real Victim? | WIRED