Honker Union

Honker or red hacker is a group known for hacktivism,  mainly present in China. Literally the name means "Red Guest", as compared to the usual Chinese transliteration of hacker (黑客, hēikè, literally Black Guest as in black hat).



The word "Honker" emerged after May 1999, when the United States bombed the Chinese embassy in Belgrade, Yugoslavia and since then, Honkers formed a Honker Union, whose members combined hacking skills with nationalism, and launched a series of attacks on websites in the United States, mostly government-related sites.

The name also suggests that a hacker in red, the color of the Communist party, is in combat with hackers in the dark. In the following years, Honkers remained active in hacktivism supporting the Chinese government against what they view as the imperialism of the United States and the militarism of Japan.

The group is currently merged with the Red Hacker Alliance.

Media coverage
While Honker Union is not directly related to Hong Kong, the fact that Honker can also mean Hongkongers has caused some confusion in the media. In January 2003, the "worm" SQL Slammer appeared in the Internet. As proof of concept exploit code for the SQL Server bug utilised by SQL Slammer, written by David Litchfield, was found in the Honker Union website, it was speculated that the worm was spread by Honker Union. The Associated Press misstated that Honker might be a Hong Kong hacking group, possibly due to aforementioned naming confusion. Though it was a mistake, Honker Union since then has been falsely connected to Hong Kong in many other documents.

Relationship with Chinese government
Although there is no evidence of Chinese government oversights of the group, with the official government stance against cyber crime of any kind, the Honker Union and other freelance Chinese hackers have a complex relationship with the Chinese government. Greg Walton noted in his studies that Chinese government has been able to use the Honker Union as a "proxy force" when Beijing's political goals converge with the group's nationalist sentiment. He also noted instances of members profited off the Chinese government for their skills and the Chinese government recruited members into security and military forces. Finally, Greg Walton pointed out that there are some calls within the group to be officially recognized and integrated into the Chinese government.

Sino-Iran Hacker War
After Chinese website Baidu was hacked by the Iranian Cyber Army in 2010, Chinese hackers claiming to be members of the Honker Union began retaliating attacks on Iranian websites. Iranian educational website iribu.ir was hacked. At first the iribu.ir home page turned to black screen, then the words "Long live The People's Republic of China" appeared. Numerous other Iranian governmental websites were also attacked.

Attack against the Philippines
After the 2010 Rizal Park hostage-taking incident, Bulacan provincial government's website was attacked by Chinese hackers.

Sino-Vietnamese Hacker War
As the South China Sea disputes between China and Vietnam worsened in 2011, numerous Chinese website were attacked by Vietnamese hackers, displaying Vietnamese nationalist slogans such as "Vietnamese Hackers are the Best", "Vietnamese People is Willing to Sacrifice to Protect the Sea, Sky and Nation" etc. The Honker Union retaliated with attacks on reportedly "more than a thousand Vietnamese websites", displaying the Chinese national flag and nationalist slogans on their homepages.

Sino-Philippines Hacker War
In April 2014, the Scarborough Shoal standoff triggered a so-called "hacker war" between China and the Philippines. Numerous Chinese websites, including cyol.net and v.cyol.com and five others, came under attack from Philippine hackers. Chinese hackers also attacked the homepage of the University of the Philippines, turning it into a map of the disputed Scarborough Shoal, along with slogans such as "We Come From China" and "Huangyan Island is Ours". (Huangyan Island is the Chinese name for the Scarborough Shoal)

Tsering Woeser
In May 2008, the Tibetan writer/blogger and political dissident Tsering Woeser, was reported to be under cyber-attack through her Skype and email accounts being impersonated, also her website was hacked. This attack was claimed by Honker Union.

Attacks against Japanese websites
After the Japanese government announced a plan to purchase the Senkaku Islands (called Diaoyu Islands in China), Honker Union denounced the move and called it a declaration of war. They then listed 100 Japanese entities as targets. For two weeks after that, Japanese central and local governments, banks, universities, and companies experienced various cyber attacks. These attacks include defacing of websites and distributed denial of service (DDoS) attacks.