How to Trace Hacktivism Back to a 1998 Media Hoax

Hacktivism sounds like a word that grew out of real protest movements. It did not. A member of the Cult of the Dead Cow, the Texas hacker group, coined the term while the group prepared a media hoax about a fictional Chinese dissident crew called the Hong Kong Blondes, then fed the story to reporters who had no way to check it.

What Is Hacktivism and Who Invented the Term?

Hacktivism is the use of computer intrusion or the public claim of intrusion to advance a political cause, and the word was coined inside the Cult of the Dead Cow (CDC), the Texas hacker group, while it prepared the Hong Kong Blondes operation in the late 1990s. CDC member Omega is credited in the transcript's account with combining hacking and activism into the portmanteau, a claim consistent with the group's own framing of the term as a product of that specific project.

The distinction matters because hacktivism is frequently described as a broad social phenomenon that emerged organically from many groups. The record points to a narrower origin: one group, one fabricated crew, one press cycle, one new word. The Cult of the Dead Cow had already spent more than a decade publishing text files, ASCII art and parody writing when the term appeared, so the coinage came from people whose primary output was writing, not intrusion.

By the time the Hong Kong Blondes were announced, mainstream coverage of hackers already leaned on a set of stock images. The Blondes story supplied a new one: a stylish, globe-trotting Chinese dissident who fought censorship from outside the country. That image, more than any technical achievement, is what carried the term into common use.

Hong Kong Blondes: How a Hoax Was Built

The Hong Kong Blondes were announced at the Beyond HOPE conference on August 10, 1997, in front of an audience that organizers put at more than 2,000 people. According to Oxblood Ruffin, the CDC member who ran the project, the group was assembled from a mix of fact and invention: some real people and events, wrapped in a fictional identity and a fictional leader named Blondie Wong.

Ruffin has described the result as 'true disinformation,' a phrase he used later to explain the method. Facts drawn from real people were recombined and attached to a character who did not exist as presented, with details altered to protect the identities of people who did. The July 15, 1998 interview with Blondie Wong is the clearest example: it reads as a profile of a specific man, and it was assembled from IRC conversations and the biographies of several different people.

The timing was deliberate. Ruffin has said he published the Blondie Wong interview about a week before Def Con, so that the Blondes story would ride the attention already gathering around the group's Back Orifice release. Two CDC projects, one real tool and one fabricated ally, could amplify each other in the same news cycle.

CDC, Back Orifice, and Why Microsoft Was the Target

Back Orifice was a remote administration tool for Windows released by Cult of the Dead Cow at Def Con in 1998, written by CDC member Sir Dystic, and its public demonstration is the event that made the group's later claims harder to dismiss. The tool gave an operator control of a Windows machine over a network, and CDC distributed copies on CD at the conference while the press watched.

The choice of target was not arbitrary. Microsoft was expanding into the Chinese market during the same period, and Ruffin has said that Western technology firms supplying censorship infrastructure in China was one of the two issues he wanted the Blondes project to raise. The other was human rights in China.

For readers trying to place the tool in context: Back Orifice's significance to the Blondes story is reputational, not technical. CDC had demonstrated that it could build and ship real software that embarrassed a major vendor, so when the same group described a Chinese hacktivist crew, journalists treated the account as credible. The fabricated project borrowed authority from the real one.

How the Hoax Reached Wired and the New York Times

The Hong Kong Blondes reached major Western outlets because the story had no verifiable counterpart to check it against. Ruffin has said the coverage moved first through Wired's online operation and then spread to outlets including the New York Times. Claims about defaced Chinese government websites and disrupted systems circulated without independent confirmation, which is exactly the condition the operation was designed to create.

Hong Kong journalists were the exception. Ruffin has acknowledged that some Hong Kong press outlets responded by saying they had no record of the group and suspected a hoax. Roughly two decades passed before anyone involved published an account of how the story had been constructed; Ruffin's own write-up appeared in 2015, the first public admission that the operation had been fabricated in large part.

The gap between 1997 and 2015 is the useful number here. For about eighteen years, the mainstream record contained a hacker group that had never existed in the form described, and the correction came from the person who built it, not from a newsroom.

Anonymous and the Hacktivism Playbook

Modern hacktivist claims follow the Hong Kong Blondes template: the perceived attack matters more than the verified one. Anonymous, the decentralized activist collective that became the most visible hacktivist brand of the 2010s, has repeatedly been credited with intrusions that were never confirmed. The pattern is not that every claim is false; it is that the claim itself produces coverage, and the correction rarely catches up.

The mechanic is straightforward to describe. A group publishes a statement, a deadline, a target list, or an alleged breach. Outlets report the claim with attribution, readers share it, and the cycle moves on before verification can happen. CDC built the first widely reported version of this mechanic in 1997 and 1998, and the incentives that made it work have not weakened.

One caveat belongs here. Treating the Blondes as the origin of a media pattern is an argument about method and lineage, not proof that later groups copied it consciously. Hacktivists who have never read about CDC can still rediscover the same asymmetry between claiming an attack and proving one.

What Was Real Behind the Hong Kong Blondes Hoax?

Part of the Hong Kong Blondes story was true. The character of Blondie Wong was based on a real person Ruffin met in Toronto at an after-hours club called the Matador, and the man was not a hacker. According to Ruffin's later account, the prototype was a wealthy Chinese expatriate who moved in circles that helped dissidents leave China.

The real operation used criminal networks, not exploits. Ruffin has described a fee of roughly 30,000 US dollars to extract people from Hong Kong, with the network moving them to countries where the gangs involved were active. The name has a different meaning than most readers assume: in Hong Kong slang, 'blond' refers to gold, so 'more Hong Kong Blonds' meant more money for the smuggling effort.

Ruffin also said two people around the real figure were technically competent computer science students, and that he embellished them for the story. The fiction was built from that thin technical layer, a wealthy expatriate, a bodyguard character and details borrowed from other people.

CDC: How the Group Actually Operated

Cult of the Dead Cow behaved less like a criminal organization than a publishing house with a shared aesthetic. The group started in Texas in 1984, took its name from an abandoned slaughterhouse near one member's home, and built its reputation on text files, ASCII art, parody writing and an invented mythology rather than on intrusions.

The group also had a deliberate media strategy. CDC member the Death Vegetable has described acting as a point of contact and using the joking title 'Minister of Propaganda,' and has said the approach was 'global domination through media saturation.' Members spoke to television and print reporters in character, using prepared personas.

The Texas group's early habits were ordinary for the era. Members made free long-distance calls through phone-network manipulation, shared cracked software and, in at least one case, went dumpster diving behind businesses for documents. None of that separated them from hundreds of other bulletin-board crews. The writing and the persona work did.

Why the Hong Kong Blondes Hoax Still Matters

The Hong Kong Blondes operation ended in 1999, when Cult of the Dead Cow issued a press release saying it had ended its relationship with the group. Ruffin has said the coverage did not achieve his main aim, because reporters were more interested in sexy Chinese hackers than in Western firms helping build censorship infrastructure.

The secondary effect was larger. 'Hacktivism' moved from a coinage inside one group to a standard term in security journalism, and the tactic of treating a claim as a story whether or not it can be verified became routine. Anyone reading a hacktivist claim can apply the Blondes test: ask what would count as confirmation, and whether anyone is actually looking for it.

For more on the group, the Cult of the Dead Cow maintains its own record of the period, and Oxblood Ruffin's 2015 write-up of the operation remains the primary first-person account of how the hoax was built.

FAQ

• Who invented the term hacktivism? The word was coined inside the Cult of the Dead Cow, the Texas hacker group, while members prepared the Hong Kong Blondes operation in the late 1990s. CDC member Omega is credited with combining hacking and activism into the portmanteau. The group used it to describe a specific project before the term spread into general use.

• Was the Hong Kong Blondes group real? The group was largely fabricated. Oxblood Ruffin, the CDC member who built the operation, published an account in 2015 describing it as heavily invented and using the phrase 'true disinformation.' Some elements came from real people and events, including the man who inspired the Blondie Wong character, but the hacker group as presented in the press did not exist.

• When did the Hong Kong Blondes story start? The group was announced at the Beyond HOPE conference on August 10, 1997, and the interview with the fictional leader Blondie Wong was published on July 15, 1998. Ruffin timed the interview to appear about a week before Def Con so it would benefit from attention around CDC's Back Orifice release.

• What was Back Orifice and who wrote it? Back Orifice was a Windows remote administration tool released by Cult of the Dead Cow at Def Con in 1998 and written by CDC member Sir Dystic. It gave an operator control of a Windows machine over a network. CDC distributed copies on CD at the conference, and the release made the group's later claims more credible to journalists.

• Did the Hong Kong Blondes hoax actually accomplish anything? It raised the profile of the term hacktivism and demonstrated that a fabricated hacker group could generate sustained international coverage. Ruffin himself has said the coverage largely missed his intended point about human rights in China and Western firms supplying censorship technology. The measurable outcome was the media template, not the political result.

• Why did Cult of the Dead Cow target Microsoft? Microsoft had a major presence in China and was one of the vendors Ruffin wanted to call out for supporting censorship infrastructure. The company also had a poor security record in Windows during the 1990s, which CDC members had reported without visible response. Back Orifice was designed to force a public reckoning on the security side.

• How did the Hong Kong Blondes name originate? In Hong Kong slang, 'blond' means gold. According to Ruffin's account, the man who inspired Blondie Wong needed money to pay smuggling networks to extract dissidents from China, so the phrase 'more Hong Kong Blonds' meant more funding. The name was chosen with that double meaning in mind.

• What can hacktivist claims teach security teams now? The Blondes operation showed that unverified claims can travel further than confirmed incidents when no one checks them. Security teams that treat public hacktivist statements as confirmed breaches risk wasting resources and misreading the threat. Treating claims as claims, and asking what evidence would confirm them, is the practical lesson.

• Where can I read the original accounts? Oxblood Ruffin's 2015 write-up of the Hong Kong Blondes operation is the main first-person source, and Cult of the Dead Cow keeps its own record of the group's history and publications. Wired's 1998 coverage is the earliest mainstream account of the Blondes. Reading the two side by side shows how much of the original story was constructed.

Closing

For a group that made its name on fabricated allies and borrowed credibility, the Cult of the Dead Cow produced one genuine and durable export. The word hacktivism moved from a private joke about a made-up crew into the vocabulary that security reporters, researchers, and attackers still use in 2026, and the tactic behind it, using an unverified claim to generate coverage, has outlasted every group that used it.

Also, if you have Dev doido, Crazystack typescript, or similar projects on your mind, the same lesson applies. A tool that works is not the same as a tool that gets read, and the projects worth following are the ones that ship something real and then talk about it in plain language. You can see the Crazystack examples for one approach, and remember that Skala blog is what happens when someone takes a long recording seriously enough to turn it into something readable.

If you have hours of recorded knowledge sitting in a video, whether an interview, a talk, or a story like this one, you can turn it into a written article by pasting the YouTube URL into Skalablog, letting it transcribe the video, and editing the result into something you would actually publish.

Skala Blog

Source video