str0ng
Attribution profile
- Type
- Hacker
- Location
- China
- Known incidents
- 2 incidents
- Sources
- 1 source
- First seen
- 2014-09-23
- Last seen
- 2017-10-25
- Updated
- 2026-10-15 06:59
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known by the aliases str0ng and n3tr1x, reportedly based in China, has been linked to two compromises of the jQuery website. In September 2014 the actor injected malicious code into jquery.com that redirected visitors to exploit kits delivering credential‑stealing malware, thereby targeting privileged enterprise IT accounts to gain unauthorized access to corporate networks. In October 2017 the actor defaced the official jQuery blog (blog.jquery.com) by publishing a fraudulent post under a core team member’s name, gaining access possibly through password reuse or a WordPress vulnerability; the attack was limited to site defacement and did not reach the library‑hosting server. Observed tactics include leveraging compromised credentials—potentially via password reuse—and exploiting known or zero‑day flaws in WordPress to obtain initial access, then deploying exploit kits and credential‑stealing malware for the 2014 operation. No public attribution to a state sponsor or criminal consortium has been made beyond the geographic hint of China.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 1 source.