Abstract: The People’s Republic of China’s cybersecurity industry is underpinned by a deeply embedded mindset: to defend, one must first know how to attack (未知攻，焉知防). Popularised in the 1990s by Taiwanese hacker Lin Zhenglong (“Coolfire”), this defence-through-offence philosophy has shaped generations of self-taught hackers, patriotic hacktivist groups, and eventually a new class of Capture the Flag-trained entrepreneurs. Today, the concept finds its clearest institutional expression in corporate “attack-defence labs” run by firms such as Qihoo 360, Tencent, and Qi An Xin, and reinforced by state policy that treats private companies as part of China’s cyber attack-and-defence apparatus. Several attack-defence labs have been directly linked to offensive tool development, exploit research, and support for state cyber operations.

Problem statement: What structural role do China’s attack-defence labs play in generating offensive cyber capability, and what does that mean for the broader threat landscape?

So what?: The fusion of offence and defence within a single personnel, tooling, and research pipeline gives China a structural advantage in developing offensive cyber capabilities. That makes attack-defence labs a distinct unit of analysis for tracing where Chinese offensive capability actually comes from and how it is operationalised. This matters for attribution and intelligence even when the labs’ organisational model can’t be directly disrupted.

Introduction

The frequency and persistence of cyber threats have exposed the limitations of purely passive approaches to cybersecurity. A limited but growing number of states have therefore adopted forms of active cyber defence, based on the premise that effective defence requires more than detecting and responding to attacks. It also requires proactive measures to identify, disrupt, and degrade adversaries before they can achieve their objectives.[1]

The United States has formalised this approach through its 2018 Department of Defence Cyber Strategy, which introduced the doctrine of “Defend Forward”. The doctrine authorises U.S. Cyber Command and the National Security Agency (NSA) to operate within adversary networks to identify and disrupt malicious cyber activity before it can reach U.S. systems. Elements of this approach have subsequently been adopted by other governments.[2] China presents a different model. Rather than articulating a dedicated doctrine of active cyber defence comparable to Defend Forward, Beijing’s approach is rooted in the broader military principle of active defence (积极防御), a longstanding feature of Chinese strategic thought that has been extended to cyberspace. China’s 2015 military strategy explicitly incorporated cyberspace into this framework, but stopped short of establishing a distinct operational doctrine for active cyber defence.[3] Yet the absence of a formal doctrine does not mean that the underlying logic is absent from China’s cyber ecosystem. Instead, it is reflected in a longstanding emphasis on offensive capabilities as a foundation for effective defence. This logic is captured by the maxim, “To defend, one must first know how to attack” (未知攻，焉知防).[4] The underlying philosophy emerged within China’s grassroots hacker communities before being articulated in this formulation by prominent hacker Yu Yang (于肠, TK) in 2013. It subsequently spread beyond hacker communities into China’s broader cybersecurity ecosystem, where offensive techniques came to be understood as essential to understanding, anticipating, and defending against attacks.

Unlike in much Western policy and institutional practice, where offensive and defensive cyber capabilities are generally more clearly differentiated, China frequently treats the two as mutually reinforcing components of cybersecurity. This distinction shapes how capabilities are developed, commercialised, and potentially channelled towards state objectives. One of its clearest manifestations is the growth of “attack-defence labs” within Chinese cybersecurity companies: internal units that combine defensive research, offensive experimentation, live-fire exercises, vulnerability discovery, and product development.  These labs have become a major engine of cybersecurity innovation[5] and likely serve as key enablers of the country’s advanced persistent threat (APT) groups, given China’s extensive reliance on private-sector proxies for cyber operations.[6]

This piece traces that mindset from its 1990s hacker origins through its institutionalisation in today’s attack-defence labs, examines how several of these labs have been tied to state-sponsored operations, and highlights how this model enables China to scale offensive cyber capabilities while creating new challenges for attribution.

“Coolfire” and the Origins of China’s Defence-through-Offence Mindset

In the mid-1990s, during the early years of China’s internet, hacking was less a profession than a form of exploration. With few formal institutions to train aspiring security experts, the country’s first generation of hackers turned instead to underground forums, online hacking manuals, and peer-led learning networks.

Within this first generation of hackers, the defence-through-offence philosophy was popularised by influential Taiwanese hacker Lin Zhenglong (林正龙), known as “Coolfire”.[7] In “A Top-Secret Analysis of Hacker X-Files,” posted on the website of the Changzhou Computer Information Network Security Association (常州市计算机信息网络安全协会) in 2009, he was described as “the number one hacker in China.”[8] His “Hacker Entry-Level Tutorial Series” (黑客入门教程系列), a collection of eight articles, became the first structured hacker training material available to Chinese speakers.[9]Many early hackers, including Xfocus member Wang Yingjian (王英键, casper) and Green Army founder Gong Wei (龚蔚, goodwell), credited his work as foundational to their entry into hacking.[10]

Coolfire framed offensive skills as essential for defensive awareness. In the introduction to his manual, he wrote: “This is not an instructional document, but rather a guide to show you how to crack a system so that you can better protect your own system. If you read through this entire document, you will understand how hackers infiltrate your computer. I am Coolfire, and the purpose of writing this article is to raise awareness about the importance of computer security, not to teach people how to crack passwords. If anyone uses this document to maliciously hack into others’ computers or networks, I bear no responsibility!!” (这不是一个教学文件, 只是告诉你该如何破解系统, 好让你能够将自己的系统作安全的保护, 如果 你能够将这份文件完全看完, 你就能够知道电脑骇客们是如何入侵你的电脑, 我是 CoolFire, 写 这篇文章的目的是要让大家明白电脑安全的重要性, 并不是教人 Crack Password 若有人因此文件 导致恶意入侵别人的电脑或网路, 本人概不负责 !!).[11]

Learning by Breaking

By the early 2000s, the defence-through-offence mindset had been adopted by Chinese hacktivist groups targeting perceived threats from the U.S., Taiwan, and Japan. These groups, such as the China Eagle Union, the Green Army, and the Honker Union of China, combined this approach with nationalist ideology, framing offensive cyber operations as legitimate acts of patriotic defence.[12]

China Eagle Union leader Wan Tao (万涛, Eagle) stated in 2013 that in the early 2000s, “We thought it was our responsibility to defend China,”[13] while the group’s website declared: “Without real offensive practice, how can we prove our shield is truly strong?” (如果没有真正意义上的攻击实践，拿什么来证明我们的盾是坚硬的呢？)[14]Similarly, Honker Union founder Lin Yong (林勇) claimed in 2010 that their goal was strictly defensive—that the group had no interest in politics and worked only for the security of Chinese websites.[15]

For these groups, offensive operations were not only a form of patriotic defence but also the most effective way to gain real-world hacking skills. In the early 2000s, China had few formal pathways for hands-on practical skills. Dedicated university cybersecurity programmes were limited, and widely accessible training platforms such as Capture the Flag (CTF) competitions,[16] bug bounty programmes,[17] and cyber ranges[18] were still years away. In this vacuum, hacker groups emerged as de facto training academies. Groups such as China Eagle Union, 0x557, and Xfocus organised around collaboration, mentorship, and skill-sharing—grounded in the belief that mastering offensive techniques was essential for effective defence.

In practice, this often meant targeting real-world systems. In a 2009 article, Wan Tao (万涛, eagle), founder of the China Eagle Union, noted: “When you don’t have certain resources, you can only look for [attack targets] on the Internet” (当自己没有一定资源的话，只能在互联网上寻找（攻击对象.”[19] Reflecting on the past at the INSEC WORLD 2020 conference in Chengdu, Wang Junqing (王俊卿, la0wang), founder of 0x557, said that the late 1990s and early 2000s environment gave early hackers the space to hone their network attack skills on real-world targets, and that today the equivalent path runs through CTFs, vulnerability testing, and other security competitions.[20]

By the late 2000s, many self-taught hackers began to professionalise. Notable companies founded by members of early hacker groups included Knownsec (2007), DBAPP Security (2007), and Pangu Lab (2014)—all of which embedded the “to defend, one must first know how to attack” principle into their business models.[21]

However, into the early 2010s, the broader industry largely focused on antivirus software and basic enterprise protection. It wasn’t until demand for more advanced capabilities grew that offensive knowledge became a strategic asset.

Institutionalising the Attack-Defence Mindset

The formalisation of the defence-through-offence model accelerated in the early 2010s, spurred by international success, economic opportunity, and policy shifts. The 2013 revelations by former NSA employee Edward Snowden were an inflexion point. They exposed the scale of US surveillance and revealed China’s own cyber vulnerabilities, catalysing a national reassessment of cybersecurity priorities.

“The Snowden files were a really big deal for us,” said retired People’s Liberation Army (PLA) Colonel Lyu Jinghua.[22] Xfocus members and Knownsec founders Zhao Wei (赵伟, icbm) and Yang Jilong (杨冀龙, watercloud) echoed that view: according to Zhao, the Snowden revelations confirmed China’s worst fears—that US intelligence operated in “God Mode,” with near-limitless access to private communications. “We have Snowden to thank,” Yang noted in 2016, “his revelations made China increasingly aware of its gap with the rest of the world” (我们需要感谢斯诺登,因为他的出现,中国才逐渐看到了与世界的差距).[23]

In 2014, President Xi Jinping elevated cybersecurity to a national strategic priority, calling for China to become a “cyber powerhouse” (网络强国).[24] The private sector quickly aligned. As a 2022 article by 36Kr—China’s equivalent of TechCrunch and a publicly listed media company focused on technology and finance —titled “The Invisible Smoke: Thirty Years of Ups and Downs in China’s Cybersecurity” (看不见的硝烟：中国网络安全三十年沉浮史) observed, the cybersecurity component was, in 2014–2015, the hottest sector in the A-share market, with any listed company whose main business included cybersecurity sought after by investors.[25] The industry has since grown steadily, averaging an annual growth rate of 12.4%, according to data from the Chinese Ministry of Industry and Information Technology (MIIT).[26]

At the same time, Chinese university CTF teams—particularly from Tsinghua, Zhejiang, and Shanghai Jiao Tong—began to shine in international attack-defence live-fire competitions (实战化演练), such as the prestigious DEFCON CTF held annually in Las Vegas.[27] These competitions embody the “defence through offence” principle: teams must defend their systems while simultaneously launching attacks on others. Chinese success brought global recognition and national prestige, reinforcing the value of offensive training as a legitimate path for cyber talent development.

This dual momentum—top-down state prioritisation of cybersecurity as a national security imperative, and bottom-up recognition of Chinese hacking talent on the global stage—catalysed the growth of China’s domestic hacking competition ecosystem.[28] Between 2004 and 2013, only a few such events were held each year. That changed in 2014 with the launch of Baidu Capture The Flag (BCTF), China’s first attack-defence CTF explicitly modelled on DEFCON CTF.²⁹ From 2017 to 2023, China hosted between 37 and 56 hacking competitions annually, many centred on real-time attack-defence formats.[29]

This grassroots momentum was reinforced by doctrine. The 2013 edition of the Science of Military Strategy—published by the PLA Academy of Military Science, the PLA’s highest-level research institute—argued that the ubiquity of the internet and the blurring of civilian–military networks had expanded the number of actors engaged in cyber operations.[30] Alongside dedicated military cyber units and relevant government departments such as the Ministry of Public Security (MPS) and the Ministry of State Security (MSS), the document explicitly included civilian forces, including private companies, as part of the teams conducting cyber attacks and defence.

A New Generation of Entrepreneurs Focused on Attack-Defence Live-Fire Capabilities

While attack-defence was already a central focus for companies founded by elite hackers active in forums during the 1990s and 2000s, it has since become its own industry segment – now driven by a new generation of hackers trained within a far more structured and state-aligned system. Unlike their predecessors, who came of age reading hacker magazines and teaching themselves online, these post-90s entrepreneurs emerged from formal cybersecurity education, CTF training circuits, and research labs.[31]

According to a December 2023 analysis by Anquan 419, a media company focusing on China’s cybersecurity industry development, the cybersecurity market is shifting from a compliance-dominated model to one increasingly focused on attack-defence, driven by national policy support, growing market demand, and rapid technological innovation.[32] A January 2025 report published by the Hufu Think Tank (虎符智库), which was founded by China’s top cybersecurity company Qi An Xin, further supports this trend, noting that attack-defence live-fire capability is increasingly regarded as the primary engine of innovation in the sector.[33] Many of today’s most prominent cyber firms were founded by former CTF champions, whose experience in attack-defence contests laid the foundation for commercial tools and services, including red teaming, penetration testing, breach simulation platforms, cyber ranges, and threat intelligence.

Founders like Chen Peiwen (陈佩文), who leads Boundary Unlimited (边界无限), Kevin Shen (沈凯文) of Yunqi Wuyin (云起无垠), and Shu Junliang (束骏亮) of Feiyu Security (蜚语安全) all led top university CTF teams before launching startups grounded in offensive capabilities.[34] Their companies now specialise in fuzzing, application security, and secure software development—sectors where offensive skills are a strategic advantage. According to Chen Peiwen, enterprise and government clients increasingly demand measurable results, prioritising active threat simulation and mitigation over policy compliance.

Other founders, such as Zhang Ruidong (张瑞冬), who heads NoSugar Information Technology (无糖信息), and Yang Changcheng (杨常城), founder of Zhongan Netstar (中安网星), have applied offensive techniques to fraud detection, identity threat defence, and support for law enforcement.[35] Collectively, they represent a generational shift in China’s cybersecurity industry—one where defence-through-offence is no longer just a guiding principle, but a commercial strategy.

Attack-Defence Labs

This defence-through-offence mindset is best manifested through dedicated corporate units known as attack-defence labs (攻防实验室), where offensive research, defensive engineering, and live-fire experimentation are integrated into a single operational model.

Over roughly the past 15 years, China’s leading technology and cybersecurity firms—including Alibaba, Baidu, Tencent, Qihoo 360, Knownsec, Qi An Xin, DBAPP, and Sangfor—have each built prominent labs around this model. Sangfor’s “6+1” laboratory, for instance, forms the backbone of its offensive-defensive capability system, explicitly framed around Xi Jinping’s characterisation of cybersecurity as a contest fought on both offensive and defensive fronts. DBAPP’s Starfire Lab similarly centres on live-fire exercises, attack simulation, and vulnerability discovery. The scale of investment is substantial: Qihoo 360 alone operates 19 specialised labs, Tencent runs 7 to 10, and Qi An Xin maintains 15, covering areas ranging from backdoor detection and threat attribution to industrial-control and vehicle security.[36]

Alongside these giants, a parallel ecosystem of boutique attack-defence firms has emerged, often founded in the early-to-mid 2010s by veterans of the larger companies. Cyber Kunlun, spun out of Qihoo 360 in 2021 by former Vulcan Team and CTO talent, now runs its own advanced offensive-defensive research team. Pangu Labs, historically known for its iOS jailbreaking work and acquired by Qi An Xin in 2021, embodies the same “offence promotes defence” logic. Sichuan Silence, once part of pioneering firewall developer Topsec, hosts the Double Helix Attack and Defence Laboratory.[37] Several of these labs have built international reputations through strong showings in hacking competitions and US bug-bounty programs, reinforcing their credibility and drawing both investment and government attention.

Demand for this model continues to grow. Industry analysis from Anquan 419 and a Hufu Think Tank report (Hufu being founded by Qi An Xin) both describe the cybersecurity market shifting away from compliance-driven work toward attack-defence capability as the primary engine of innovation.[38] This shift is now being codified in policy: a July 2025 draft regulation would require certified cybersecurity assessment organisations to maintain a dedicated attack-defence lab staffed by at least 10 technicians experienced in national-level security monitoring and emergency response—a substantial expansion beyond the 2018 requirements, which did not mandate such labs.[39]

The model has attracted international commercial interest in the past. Tencent’s Keen Lab, known for automotive security research, won a 2018 BMW R&D award for uncovering vehicle vulnerabilities and later conducted an eight-month security audit of Mercedes-Benz systems, disclosing several serious flaws, including remote code execution bugs. This illustrates how China’s attack-defence labs have become recognised contributors to global cybersecurity research over time, even as they remain closely tied to state interests.[40]

Attack and Defence Labs assist State-Sponsored Cyber Operations

Chinese government agencies have increasingly drawn on the capabilities of attack-defence labs within domestic cybersecurity firms to support state cyber operations with offensive tool development, vulnerability research and exploitation, and counter-cybercrime support.

A first set of examples illustrates how attack-defence labs contribute to operational offensive tooling. Integrity Tech, one of China’s leading cyber range developers, was linked to the Flax Typhoon threat actor. According to a 2024 FBI affidavit, the group used an application called “Sparrow” (麻雀) to control a botnet capable of file transfers, remote command execution, lateral movement, and cyberattacks. The Sparrow repository, along with embedded tools, repeatedly referenced the “KRLab,” Integrity Tech’s internal attack-defence lab.[41] A similar pattern emerged in November 2025, when MSS-affiliated clusters including UNC5174 were linked to the dual-use VShell remote access tool (RAT). In a 2025 report, European cybersecurity firm NVISO assessed that DBAPP Security’s Starfire Lab maintained VShell.[42] The report noted that VShell began as a defensive research project around 2021 but later evolved into a functional backdoor used by several China-nexus threat actors. How the tool moved from DBAPP’s lab into operational use remains unclear.

The Chinese state has also worked to capture vulnerability research itself, often at minimal cost. It first curtailed Chinese participation in overseas exploit hacking contests, where security researchers from China’s leading attack-defence labs compete to discover and demonstrate unknown software vulnerabilities previously. In 2018, new rules required government approval to compete internationally and mandated that discovered vulnerabilities be reported to “public security and other relevant departments,” effectively ending Chinese participation in foreign exploit competitions.[43] As China built domestic equivalents, media and threat intelligence reporting has suggested that some vulnerabilities uncovered in these contests were passed to the MSS and the MPS for potential operational use.[44] By 2021, the “Regulations on the Management of Security Vulnerabilities in Network Products” (RMSV) required anyone doing business in China to report vulnerabilities to state authorities within forty-eight hours of discovery.[45] Microsoft warned in its 2022 Digital Defence Report that the rule “might enable elements in the Chinese government to stockpile reported vulnerabilities toward weaponising them”.[46] RMSV’s legal chill effect is complemented by the China National Vulnerability Database of Information Security (CNNVD), an MSS-run system through which firms voluntarily disclose vulnerabilities in exchange for payments, certificates, and titles that boost eligibility for government contracts, an incentive structure credited with the steady growth of CNNVD’s network of “technical support units”, where vulnerability research expertise is often concentrated in attack-defence labs.[47]

Another set of cases illustrates that beyond China’s mandated vulnerability disclosure system, some labs also appear to develop exploit code.[48] In October 2024, threat intelligence firm Sophos’s “Pacific Rim” investigation observed devices executing commands consistent with exploit development and concluded that they belonged to Sichuan Silence’s Double Helix Research Institute, an attack-defence lab.[49] In the same period, a Financial Times investigation drawing on intelligence in a White House national-security memo reported that Alibaba employees “had transferred knowledge about ‘zero-day’ exploits to the PLA.” ^[50] Although the report did not specify the internal Alibaba unit involved, the reference to zero-day vulnerability or exploit work could point to Alibaba’s Orion Lab (猎户座实验室), known for conducting vulnerability research in US products.[51]

Other cases show attack-defence labs contributing to law-enforcement operations to tackle cybercrime. Pangu Labs has supported investigations by exploiting vulnerabilities and using targeted phishing to infiltrate suspects’ systems.[52] Integrity Tech’s KRLab similarly claimed to provide long-standing cybercrime intelligence and investigative support to national and provincial public security organs, helping resolve hundreds of cases.[53]

From Underground Ethos to Strategic Asset

The evolution of China’s defence-through-offence mindset in cyberspace and its institutionalisation echoes Coolfire’s original lesson: you cannot truly secure a system without first understanding how to break it. Once a hallmark of underground hacker culture, this principle is now embedded in China’s cybersecurity architecture, from universities and CTF teams to companies’attack-defence labs that formalise and commercialise offensive expertise as a driver of cybersecurity innovation.

This represents a structural departure from how firms and states in Western countries generate and organise cyber capabilities. In Western countries, offence and defence are generally more institutionally differentiated: offensive operations sit within intelligence and military agencies under distinct legal authorities, while commercial offensive-cyber capabilities, where they exist, tend to operate as a specialised market alongside, rather than within, the mainstream cybersecurity industry. Spyware vendors and exploit brokers such as NSO Group and Zerodium represent a distinct commercial offensive-cyber sector, while most cybersecurity firms remain primarily oriented towards defence.

China’s attack-defence labs, by contrast, blur this boundary by design, conducting research that can serve both defensive purposes and state offensive requirements. The same personnel, tooling, and research pipelines used to identify and mitigate vulnerabilities can also produce vulnerabilities, exploits, and capabilities that may subsequently be available to state actors. This creates a potentially broader and less compartmentalised pathway between commercial cybersecurity research and state cyber capabilities than is typical in Western countries.

The result is a model that can generate offensive capability at considerable scale and with potentially greater efficiency than more compartmentalised systems. Because the tooling and even personnel move between commercial security work and state-linked operations, the origins of a given capability are often difficult to trace to a single actor, complicating attribution. For analysts and policymakers, this means the labs themselves, and the personnel, research, and tooling that pass through them, are worth tracking as closely as the intrusions or APT groups they eventually support. As China’s attack-defence industry expands and the state grows increasingly reliant on private-sector actors to conduct or support cyber operations, this will only become more important.

[1] Even as active cyber defense gains ground, public discourse around appropriate policy frameworks and operational norms continues to lag behind.

[2] “Japan Goes on Offense With New ‘Active Cyber Defense’ Bill,” Dark Reading, February 13, 2025, https://www.darkreading.com/cybersecurity-operations/japan-offense-new-cyber-defense-bill.

[3] “中国的军事战略” [China’s Military Strategy], Central People’s Government of the People’s Republic of China, May 26, 2015, https://www.gov.cn/zhengce/2015-05/26/content_2868988.htm.

[4] The phrase was first articulated in 2013 by one of China’s legacy elite hackers, Yu Yang (于肠, TK), though the underlying mindset had long existed before that; 小象 [Xiaoxiang], “‘未知攻，焉知防’是哪一年提出的？” [“What Year Was ‘To Defend, One Must First Know How to Attack’ Coined?”], DingXiang [顶象], December 8, 2022, https://archive.ph/gP4vN.

[5] While the defense-through-offense mindset exists in Western technical circles, it operates within a system primarily driven by defensive priorities, where ties to government are often commercially motivated and relatively fragmented.

[6] Natto Team, “Front Company or Real Business in China’s Cyber Operations,” Natto Thoughts, May 22, 2024, https://nattothoughts.substack.com/p/front-company-or-real-business-in.

[7] The term “honker” derives from “hongke” (红客), a transliteration meaning “red hacker.”

[8] “A Top-Secret Analysis of China’s Hacker X-Files,” Changzhou Computer Information Network Security Association (常州市计算机信息网络安全协会), 2009, cited in Eugenio Benincasa, Before Vegas, CSS Cyberdefense Report (Zurich: ETH Zurich, 2025), https://ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/before-vegas-cyberdefense-report.pdf. The original source is no longer available online.

[9] Lin Zhenglong (Coolfire), 黑客入门教程系列 [Hacker Entry-Level Tutorial Series], https://cdn.jsdelivr.net/gh/it-ebooks-0/it-ebooks-201703-part3/coolfire%E9%BB%91%E5%AE%A2%E5%85%A5%E9%97%A88%E7%AF%87.pdf.

[10] Lin Zhenglong (Coolfire), 黑客入门教程系列 [Hacker Entry-Level Tutorial Series], https://cdn.jsdelivr.net/gh/it-ebooks-0/it-ebooks-201703-part3/coolfire%E9%BB%91%E5%AE%A2%E5%85%A5%E9%97%A88%E7%AF%87.pdf; Zhihu post crediting Coolfire’s influence on early Chinese hackers, https://zhuanlan.zhihu.com/p/36410456.

[11] Lin Zhenglong (Coolfire), 黑客入门教程系列 [Hacker Entry-Level Tutorial Series], https://cdn.jsdelivr.net/gh/it-ebooks-0/it-ebooks-201703-part3/coolfire%E9%BB%91%E5%AE%A2%E5%85%A5%E9%97%A88%E7%AF%87.pdf.

[12] Eugenio Benincasa, Before Vegas, CSS Cyberdefense Report (Zurich: ETH Zurich, 2025), https://ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/before-vegas-cyberdefense-report.pdf.

[13] Hannah Beech, “China’s Hacker King,” Time, March 4, 2013, https://time.com/archive/6643185/chinas-hacker-king/.

[14] China Eagle Union forum post, archived December 12, 2004, https://web.archive.org/web/20041212061837/http:/bbs.chinaeagle.org/archive/index.php/t-98075.html.

[15] Melanie Lee and Lucy Hornby, “Google Attack Puts Spotlight on China’s ‘Red’ Hackers,” Reuters, January 20, 2010, https://www.reuters.com/article/technology/google-attack-puts-spotlight-on-chinas-red-hackers-idUSTRE60J208/.

[16] Capture the Flag (CTF) competitions are simulated cybersecurity challenges in which participants apply offensive and defensive skills—such as exploiting vulnerabilities, reverse engineering, or cryptography—to solve problems and retrieve hidden “flags” for points.

[17] Bug bounty programs are structured initiatives through which organizations offer financial rewards to independent researchers who responsibly disclose software vulnerabilities.

[18] Cyber ranges are simulated network environments used to train security professionals in realistic attack-and-defense scenarios without risk to production systems.

[19] Wan Tao interview, CNBeta, 2009, https://archive.ph/sdjBS.

[20] Wang Junqing remarks, INSEC WORLD 2020 conference coverage, Tencent Cloud Developer Community, https://archive.ph/c4qjR.

[21] Eugenio Benincasa, “The Pangu Team—iOS Jailbreak and Vulnerability Research Giant: A Member of i-SOON’s Exploit-Sharing Network,” Natto Thoughts, https://nattothoughts.substack.com/p/the-pangu-teamios-jailbreak-and-vulnerability.

[22] Eli Binder and Katrina Northrop, “The Snowden Effect,” The Wire China, December 6, 2020, https://www.thewirechina.com/2020/12/06/the-snowden-effect/.

[23] CSDN, “知道创宇CTO杨冀龙：网络安全人才决定行业格局,” 2016, https://archive.ph/NrxKG.

[24] On Xi Jinping’s 2014 elevation of cybersecurity to a national strategic priority, see Bloomsbury Collections, https://www.bloomsburycollections.com/monograph-detail?docid=b-9798881817602&pdfid=9798881817602.ch-8.pdf&tocid=b-9798881817602-chapter8.

[25] 36Kr, “看不见的硝烟：中国网络安全三十年沉浮史” [The Invisible Smoke: Thirty Years of Ups and Downs in China’s Cybersecurity], 2022, https://36kr.com/p/1748732211347072.

[26] Natto Team, “Who Has the Best Scanning Tools in China?,” Natto Thoughts, June 26, 2024, https://nattothoughts.substack.com/p/who-has-the-best-scanning-tools-in; Ministry of Industry and Information Technology of the People’s Republic of China, industry data, 2024, https://wap.miit.gov.cn/gxsj/tjfx/rjy/art/2024/art_5af672124ebc48149d9c793b6ca7ed79.html.

[27] Eugenio Benincasa, “From Vegas to Chengdu: Hacking Contests, Bug Bounties, and China’s Offensive Cyber Ecosystem,” CSS Cyberdefense Report (Zurich: ETH Zurich, June 2024), https://ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/cyber-report-2024-from-vegas-to-chengdu.pdf.

[28] Dakota Cary and Eugenio Benincasa, Capture the (Red) Flag: An Inside Look into China’s Hacking Contest Ecosystem (Washington, DC: Atlantic Council, 2024), https://www.atlanticcouncil.org/in-depth-research-reports/report/capture-the-red-flag-an-inside-look-into-chinas-hacking-contest-ecosystem/.

[29] Cary and Benincasa, Capture the (Red) Flag.

[30] In Their Own Words: Foreign Military Thought: Science of Military Strategy (2013), China Aerospace Studies Institute, Air University, https://www.airuniversity.af.edu/Portals/10/CASI/documents/Translations/2021-02-08%20Chinese%20Military%20Thoughts-%20In%20their%20own%20words%20Science%20of%20Military%20Strategy%202013.pdf.

[31] Benincasa, Before Vegas.

[32] “安全419观察丨新秀辈出 90后已成网安创业主力军,” Sohu.com, December 19, 2023, https://www.sohu.com/a/745373795_120846244.

[33] Hufu Think Tank report, SecRSS, January 2025, https://www.secrss.com/articles/74983.

[34] Natto Team, “Sichuan Silence’s Double Helix Research Institute, Winner of CTF Competitions,” Natto Thoughts, https://nattothoughts.substack.com/i/152549107/sichuan-silences-double-helix-research-institute-winner-of-ctf-competitions.

[35] “安全419观察丨新秀辈出 90后已成网安创业主力军.”

[36] Benincasa, “From Vegas to Chengdu.”

[37] Natto Team, “Sichuan Silence’s Double Helix Research Institute.”

[38] Hufu Think Tank report.

[39] Tianjin Hengyu Technology Co., Ltd. (天津恒御科技有限公司), “Major Update to the Draft ‘Capability Requirements for Cybersecurity Classified Protection Evaluation Institutions,’” hengyukeji.cn, July 18, 2025, https://web.archive.org/web/20251112161935/https:/hengyukeji.cn/NewsDetail/6014278.html.

[40] Tencent Security Keen Lab, “Mercedes-Benz MBUX Security Research Report,” Keen Security Lab, May 2021, https://keenlab.tencent.com/en/whitepapers/Mercedes_Benz_Security_Research_Report_Final.pdf.

[41] U.S. Department of Justice, FBI affidavit in support of criminal complaint related to the Flax Typhoon botnet, 2024, https://www.justice.gov/archives/opa/media/1369156/dl/dl?inline.

[42] NVISO Labs, “Decoding VShell: Insights into a Chinese-Language Cyber Espionage Tool,” November 5, 2025, https://blog.nviso.eu/wp-content/uploads/2025/11/VShell.pdf.

[43] Eugenio Benincasa and Natto Team, “China’s Vulnerability Research: What’s Different Now?,” Natto Thoughts, October 8, 2025, https://nattothoughts.substack.com/p/chinas-vulnerability-research-whats.

[44] Benincasa, “From Vegas to Chengdu”; Patrick Howell O’Neill, “How China Turned a Prize-Winning iPhone Hack Against the Uyghurs,” MIT Technology Review, May 6, 2021, https://www.technologyreview.com/2021/05/06/1024621/china-apple-spy-uyghur-hacker-tianfu/; Natto Team, “When This ‘Red Boy’ Grows Up, AI-Based Tool 360GPT Could Give China an Edge in Cyber Conflict,” Natto Thoughts, https://nattothoughts.substack.com/i/120829982/zhou-the-era-of-cyber-warfare-has-come.

[45] “Provisions on the Management of Network Product Security Vulnerabilities,” jointly issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security, July 12, 2021, English trans., China Law Translate, https://www.chinalawtranslate.com/en/product-security-vulnerabilites/.

[46] Microsoft, Microsoft Digital Defense Report 2022 (November 2022), https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/microsoft-digital-defense-report-2022.pdf.

[47] Dakota Cary and Kristin Del Rosso, “Sleight of Hand: How China Weaponizes Software Vulnerabilities,” Atlantic Council, September 6, 2023, https://www.atlanticcouncil.org/in-depth-research-reports/report/sleight-of-hand-how-china-weaponizes-software-vulnerability/; Benincasa and Natto Team, “China’s Vulnerability Research.”

[48] Benincasa and Natto Team, “China’s Vulnerability Research.”

[49] Sophos X-Ops and Ross McKerchar, “Pacific Rim: Inside the Counter-Offensive—The TTPs Used to Neutralize China-Based Threats,” Sophos News, October 31, 2024, https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/.

[50] Demetri Sevastopulo, “White House Memo Claims Alibaba Is Helping Chinese Military Target US,” Financial Times, November 14, 2025, https://www.ft.com/content/30fb83a0-8cb9-4805-b5d2-19b5ef510043.

[51] Microsoft Security Response Center, “Researcher Acknowledgments,” https://msrc.microsoft.com/update-guide/acknowledgement.

[52] CSDN, “知道创宇CTO杨冀龙：网络安全人才决定行业格局.”

[53] Guillaume Corneau-Tremblay, “Flax Typhoon: Exposing Integrity Tech’s Offensive Genes,” Threats From a Distance, September 24, 2024, https://guillaumecorneautremblay.substack.com/p/flax-typhoon-exposing-integrity-techs.