{"id":33075,"date":"2020-01-31T13:02:13","date_gmt":"2020-01-31T13:02:13","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/"},"modified":"2020-01-31T13:02:13","modified_gmt":"2020-01-31T13:02:13","slug":"chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/","title":{"rendered":"China&#8217;s Winnti hackers (apparently): Forget the money, let&#8217;s get political and start targeting Hong Kong students for protest info"},"content":{"rendered":"<p>A Chinese hacking crew which had previously been focusing on industrial and commercial attacks has now involved itself in efforts to suppress protests in Hong Kong.<\/p>\n<p><a target=\"_blank\" href=\"https:\/\/www.welivesecurity.com\/2020\/01\/31\/winnti-group-targeting-universities-hong-kong\/\" rel=\"noopener noreferrer\">Researchers at security shop ESET say<\/a> the Winnti Group, a hacking operation believed to be backed by the Chinese government, has begun targeting the networks and accounts of at least five universities in Hong Kong. Active malware infections were found at two of the schools in November of last year and ESET believes three others have since been targeted by the hackers.<\/p>\n<p>The aim of these intrusions, ESET believes, is to gather intelligence and disrupt protests by students at those universities, as Hong Kong continues to deal with civil unrest between pro-democracy protesters and the mainland government.<\/p>\n<p>According to the ESET team, the Winnti hackers have been using their namesake malware trojan \u2013 first <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/securelist.com\/winnti-more-than-just-a-game\/37029\/\">documented back in 2013<\/a> \u2013 to get into the university PCs and drop a backdoor called ShadowPad. From there, it is believed the hackers comb the infected machines for information relating to the ongoing protests.<\/p>\n<div class=\"promo_article\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/regmedia.co.uk\/2015\/03\/06\/death_star_cannon.jpg?x=174&amp;y=115&amp;crop=1\" width=\"174\" height=\"115\" alt=\"Death Star cannon\"><\/p>\n<h2 title=\"Protest organizers come under fire from network traffic barrage\">China fires up &#8216;Great Cannon&#8217; denial-of-service blaster, points it toward Hong Kong<\/h2>\n<p><a href=\"https:\/\/www.theregister.co.uk\/2019\/12\/06\/china_ddos_report\/\"><span>READ MORE<\/span><\/a><\/div>\n<p>&#8220;ShadowPad is a multi-modular backdoor and, by default, every keystroke is recorded using the Keylogger module,&#8221; explained Mathieu Tartare, the lead researcher for the ESET team studying the attack.<\/p>\n<p>&#8220;The use of this module by default indicates that the attackers are interested in stealing information from the victims&#8217; machines. In contrast, the variants we described <a target=\"_blank\" rel=\"nofollow noopener noreferrer\" href=\"https:\/\/www.welivesecurity.com\/2019\/10\/14\/connecting-dots-exposing-arsenal-methods-winnti\/\">in our earlier whitepaper<\/a> didn&#8217;t even have that module embedded.&#8221;<\/p>\n<p>The protester attacks are a departure from what the Winnti hackers usually focus on. Previously, the Chinese crew had devoted itself to financial and intellectual property heists, targeting online gaming companies and supply chain operators in the pharmaceutical, aviation, telecoms, and software markets.<\/p>\n<p>The group has gained some notoriety for its use of custom-built, sophisticated malware. The Winnti crew was among the first to <a target=\"_blank\" href=\"https:\/\/www.theregister.co.uk\/2013\/04\/11\/video_game_cyberespionage\/\" rel=\"noopener noreferrer\">make use of stolen certificates<\/a> to evade security software. \u00ae<\/p>\n<p class=\"wptl btm\"><span>Sponsored:<\/span> <a href=\"https:\/\/go.theregister.co.uk\/tl\/1889\/-8120\/detecting-cyber-attacks-as-a-small-to-medium-business?td=wptl1889\">Detecting cyber attacks as a small to medium business<\/a><\/p>\n<p>READ MORE <a href=\"https:\/\/go.theregister.co.uk\/feed\/www.theregister.co.uk\/2020\/01\/31\/winnti_hackers_students\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Supply-chain hackers now taking aim at kids fighting for democracy, say researchers A Chinese hacking crew which had previously been focusing on industrial and commercial attacks has now involved itself in efforts to suppress protests in Hong Kong.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":33076,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-33075","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>China&#039;s Winnti hackers (apparently): Forget the money, let&#039;s get political and start targeting Hong Kong students for protest info 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"China&#039;s Winnti hackers (apparently): Forget the money, let&#039;s get political and start targeting Hong Kong students for protest info 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-31T13:02:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"174\" \/>\n\t<meta property=\"og:image:height\" content=\"115\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"China&#8217;s Winnti hackers (apparently): Forget the money, let&#8217;s get political and start targeting Hong Kong students for protest info\",\"datePublished\":\"2020-01-31T13:02:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/\"},\"wordCount\":359,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/\",\"name\":\"China's Winnti hackers (apparently): Forget the money, let's get political and start targeting Hong Kong students for protest info 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg\",\"datePublished\":\"2020-01-31T13:02:13+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg\",\"width\":174,\"height\":115},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"China&#8217;s Winnti hackers (apparently): Forget the money, let&#8217;s get political and start targeting Hong Kong students for protest info\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"China's Winnti hackers (apparently): Forget the money, let's get political and start targeting Hong Kong students for protest info 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/","og_locale":"en_US","og_type":"article","og_title":"China's Winnti hackers (apparently): Forget the money, let's get political and start targeting Hong Kong students for protest info 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-01-31T13:02:13+00:00","og_image":[{"width":174,"height":115,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"China&#8217;s Winnti hackers (apparently): Forget the money, let&#8217;s get political and start targeting Hong Kong students for protest info","datePublished":"2020-01-31T13:02:13+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/"},"wordCount":359,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/","url":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/","name":"China's Winnti hackers (apparently): Forget the money, let's get political and start targeting Hong Kong students for protest info 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg","datePublished":"2020-01-31T13:02:13+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info.jpg","width":174,"height":115},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/chinas-winnti-hackers-apparently-forget-the-money-lets-get-political-and-start-targeting-hong-kong-students-for-protest-info\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"China&#8217;s Winnti hackers (apparently): Forget the money, let&#8217;s get political and start targeting Hong Kong students for protest info"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/33075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=33075"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/33075\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/33076"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=33075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=33075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=33075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}