Honker Union

Honker ({{zh|s=红客|t=紅客|p=hóngkè}}) or red hacker is a group known for hacktivism based predominantly in China. The name translates to "Red Guest", in reference to the Chinese transliteration of hacker (黑客, hēikè, literally Black Guest as in black hat). The name "Honker" suggests that a hacker in red, the color of the Chinese Communist Party, is sperate from and opposed to hackers in the dark (the "Black Guests" derived from the Chinese transliteration of the term "hacker").

Image:Honker Union logo (2).jpg

The word "Honker" emerged after May 1999, when the United States bombed the Chinese embassy in Belgrade, Yugoslavia.{{cn|date=March 2025}} In retaliation, hackers formed the Honker Union, whose members combined hacking skills with nationalism. Honker Union proceeded to launch a series of attacks on websites in the United States, with a majority of targets being government-related sites.{{cn|date=March 2025}}

In the following years, Honkers remained active in hacktivism supporting the Chinese government against what they view as the imperialism of the United States and the militarism of Japan.{{cn|date=March 2025}}

The group is currently merged with the Red Hacker Alliance.{{cn|date=March 2025}}

Media coverage

While Honker Union is not directly related to Hong Kong, but some media confused "Honker" or "Honker Union" to Hongkongers. In January 2003, the "worm" SQL Slammer appeared in the Internet. As proof of concept exploit code for the SQL Server bug utilised by SQL Slammer, written by David Litchfield, was found in the Honker Union website, it was speculated that the worm was spread by the Honker Union. The Associated Press incorrectly stated that Honker might be a Hong Kong hacking group, possibly due to aforementioned naming confusion. Though it was a mistake, Honker Union has since been falsely connected to Hong Kong in many other documents.

Relationship with the Chinese government

Although there is no evidence of the Chinese government overseeing the group{{Cite web|last=Walton|first=Gregory|date=April 2008|title=Year of the Gh0st RAT|url=http://www.beijing2008conference.com/articles.php?id=101|publisher=World Association of Newspapers{{who|date=February 2013}}|accessdate=2009-04-01|archive-url=https://web.archive.org/web/20090811031100/http://www.beijing2008conference.com/articles.php?id=101|archive-date=2009-08-11|url-status=dead}} and the official government stance being against cyber crime of any kind,{{cite news|url=http://news.bbc.co.uk/1/hi/world/americas/7972702.stm|title=China denies spying allegations|publisher=BBC News|date=March 30, 2009|accessdate=March 31, 2009}} the Honker Union and other freelance Chinese hackers hold a complex relationship with the Chinese government. Greg Walton notes in his studies that the Chinese government has been able to use the Honker Union as a "proxy force" when Beijing's political goals converge with the group's nationalist sentiment. He also notes instances where members have profited off the Chinese government as a result of their skills and, and others where the Chinese government has recruited members of the Honker Union into security and military forces. Finally, Greg Walton points to calls within the group to be officially recognized and integrated into the Chinese government as evidence to a connection.

Attacks by the Honker Union

=Sino-Iran Hacker War=

After the Chinese website Baidu was hacked by the Iranian Cyber Army in 2010, Chinese hackers claiming to be members of the Honker Union began to launch retaliatory attacks against Iranian websites. Among other affected sites, the Iranian educational website iribu.ir was hacked. When opened during the attack, the iribu.ir home page would at first turn to black screen before the words "Long live The People's Republic of China" appeared. Numerous other Iranian governmental websites were also attacked.{{Citation needed|date=February 2025}}

=Attack against the Philippines=

After the 2010 Rizal Park hostage-taking incident, Bulacan provincial government's website was attacked by Chinese hackers.{{Citation needed|date=February 2025}}

=Sino-Vietnamese Hacker War=

As the South China Sea disputes between China and Vietnam worsened in 2011, numerous Chinese website were attacked by Vietnamese hackers, displaying Vietnamese nationalist slogans such as "Vietnamese Hackers are the Best", "Vietnamese People are Willing to Sacrifice to Protect the Sea, Sky and Nation" etc.{{Citation|title=震惊！中国政府网站被越南黑客攻击并留下挑衅言语 |publisher=大旗网 |date=2011-06-04 |url=http://shehui.daqi.com/article/3129604.html |url-status=dead |archiveurl=https://web.archive.org/web/20150603143230/http://shehui.daqi.com/article/3129604.html |archivedate=2015-06-03 }} The Honker Union retaliated with attacks on reportedly "more than a thousand Vietnamese websites", displaying the Chinese national flag and nationalist slogans on their homepages.{{Citation |title = 中国红客反攻战果累累：越南溃不成军向美国求援|publisher = 西陆东方军事|year =2011|url=http://junshi.xilu.com/2011/0609/news_44_164702.html}}

=Sino-Philippines Hacker War=

In April 2014, the Scarborough Shoal standoff triggered a so-called "hacker war" between China and the Philippines. Numerous Chinese websites, including cyol.net and v.cyol.com, came under attack from Philippine hackers. Chinese hackers also attacked the homepage of the University of the Philippines, replacing the site's content with a map of the disputed Scarborough Shoal, along with slogans such as "We Come From China" and "Huangyan Island is Ours" (Huangyan Island is the Chinese name for the Scarborough Shoal).{{Citation |title = 菲外长妄称中国南海主权毫无根据中菲黑客大战|publisher = 搜狐新闻|date=2012-04-23|url=http://news.sohu.com/20120423/n341306683.shtml}}

= Tsering Woeser =

In May 2008, the Tibetan writer, blogger, and political dissident Tsering Woeser was reported to be under cyber-attack through her Skype and email. Her accounts on both were impersonated, and her website was hacked. This attack was claimed by the Honker Union.{{cite web

|title=High-profile Tibetan Writer & Blogger Woeser Under Attack

|date=27 May 2008

|url=http://blog.studentsforafreetibet.org/2008/05/27/high-profile-tibetan-dissident-writer-blogger-under-attack/

|url-status=dead

|archiveurl=https://web.archive.org/web/20080530033340/http://blog.studentsforafreetibet.org/2008/05/27/high-profile-tibetan-dissident-writer-blogger-under-attack/

|archivedate=30 May 2008

}}{{cite web

|title=Prominent Tibetan Dissident Blogger Hacked, Impersonated on Skype

|date=28 May 2008

|url=http://www.boingboing.net/2008/05/28/prominent-tibetan-di.html

|publisher=Boing Boing

}}

=Attacks against Japanese websites=

After the Japanese government announced a plan to purchase the Senkaku Islands (called Diaoyu Islands in China), Honker Union the denounced the move and called it a declaration of war. They then listed 100 Japanese entities as targets. In the two weeks following the declaration, Japanese central and local governments, banks, universities, and companies experienced various cyber attacks. These attacks included the defacing of websites and distributed denial of service (DDoS) attacks.{{cite news |title=Boosting Japan's cybersecurity |first=Mihoko |last=Matsubara |url=http://www.japantimes.co.jp/text/eo20121026a1.html |newspaper=The Japan Times |date=October 26, 2012 |accessdate=October 27, 2012}}