Loading threat actor…
Hong Kong Blondes was a dissident hacktivist group associated with pro-democracy and human-rights causes related to China. The group is known for collaborating with members of Cult of the Dead Cow, which publicly stated that it had helped the Hong Kong Blondes develop an offensive hacking capability before the two groups later separated. Historical reporting links the group to intrusions against Chinese government agencies and companies viewed as having poor human-rights records in China. Available information portrays the Hong Kong Blondes as a politically motivated actor aligned with anti-censorship and pro-democracy activism rather than financially motivated cybercrime. Publicly documented activity is limited, and high-confidence details about its membership, structure, tooling, and longer-term operational history remain sparse.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Dissident hacktivist group collaborating with cDc to target Chinese government agencies and companies associated with poor human rights practices.
Named hacking group that had worked with Cult of the Dead Cow to develop a 'lean mean hacking machine' and intended to continue its operations afterward.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.