Chinese

Profile narrative

The threat actor identified simply as "Chinese" emerged into public view through activity directed at OGUsers, an online forum widely recognized as a marketplace for trading compromised social media accounts. Operating alongside an associate known as "Disco," Chinese was identified by Krebs on Security as a previously banned member of the OGUsers community who had been promoting a rival forum. The two collaborated in a breach of OGUsers on November 25, 2020, defacing the site's homepage and claiming possession of its user database. Their intrusion exploited an outdated site plugin, a vulnerability consistent with opportunistic targeting rather than sophisticated zero-day exploitation. Disco publicly framed the action as retaliation against the forum's administrator, while denying any intention to sell or release the stolen data, though the attackers initially demanded payment from members to keep their profiles and private messages out of a threatened leak.

The strategic objective behind Chinese's activity appears tied to personal rivalry and reputational conflict within the underground ecosystem of account-trading communities, rather than financial gain, espionage, or ideological disruption. The demand for exclusion payments from individual members suggests some financial motivation, but Disco's explicit denial of intent to sell the database, combined with the framing of the breach as retribution, points primarily toward interpersonal and competitive motives within the criminal underground. The targeting of OGUsers specifically is significant given the forum's central role in facilitating SIM-swapping crimes, cryptocurrency scams, and high-profile social media account takeovers. Prior breaches of the same platform had already exposed member data and assisted law enforcement investigations into those schemes, making OGUsers a recurring target for actors seeking to destabilize or exploit the infrastructure of account hijacking.

Attribution beyond the alias "Chinese" remains limited. The name itself does not confirm nationality, ethnicity, or geographic origin, and no state nexus, criminal consortium affiliation, or broader organizational identity has been publicly established for this actor. Chinese appears to operate as an individual or within a very small partnership, evidenced by the direct collaboration with Disco on a single high-profile intrusion. There is no public reporting linking this alias to malware families, distinct tooling frameworks, or a broader campaign portfolio beyond the OGUsers breach and related retaliatory activity against that specific community. The technical approach, exploiting a known vulnerability in an outdated plugin, suggests reliance on publicly available weaknesses rather than custom-developed capabilities. Based on available sourcing, Chinese's documented activity is confined to this incident and the associated interpersonal conflicts within the account-trading underground, with no confirmed connections to state-sponsored operations, larger cybercrime syndicates, or additional independent campaigns.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.