Researcher claims Salt Typhoon spies attended Cisco training scheme
(2025/12/11)
- Reference: 1765456946
- News link: https://www.theregister.co.uk/2025/12/11/salt_typhoon_cisco_training/
- Source link:
A security researcher specializing in tracking China threats claims two of Salt Typhoon's members were former attendees of a training scheme run by Cisco.
SentinelLabs' Dakota Cary linked Yu Yang and Qiu Daibing, two alleged members of the Chinese state hacking group, to participants of the 2012 Cisco Networking Academy Cup.
The initiative is still going today. It typically runs for a few months and is geared toward beginners learning foundational cybersecurity skills, which are then tested in competitions like capture the flag events.
[1]
Both Yu and Qiu are co-owners of Beijing Huanyu Tianqiong, one of the Chinese tech companies that international [2]security advisories specify as being fronts for Salt Typhoon activity.
[3]
[4]
Digging into their pasts, Cary found that Yu and Qiu represented Southwest Petroleum University in Cisco's academy cup in China. Yu's team placed second in the Sichuan region, while Qiu's team won it and later placed third nationally, despite the university not carrying a significant pedigree in academic excellence.
The researcher also noted the link between Yu and Qiu's participation in Cisco Networking Academy Cup, the training that came with it, and the products he says they later went on to exploit at Beijing's behest.
[5]
He [6]said : "The Cisco Networking Academy began in 1997 and entered China's market in 1998. Among the content covered in Cisco Networking Academy were many of the products Salt Typhoon exploited, including [7]Cisco IOS and ASA Firewalls ."
First publicized in 2024, international cyber agencies have since said that the expansive campaign carried out by Salt Typhoon led to compromises of at least 80 global telecoms companies.
Those attacks allowed China to snoop on secret communications between elected officials, US law enforcement's [8]CALEA requests, and more. The campaign remains one of the [9]most severe and sensitive cybersecurity breaches in US history.
[10]
"All of that high-tech novelty disguises a tale as old as time: skilled master trains apprentice, apprentice masters skills with tutelage, apprentice usurps the master owing to some core ideological difference between the two that festers over time," Cary said.
[11]FCC guts post-Salt Typhoon telco rules despite ongoing espionage risk
[12]Salt Typhoon hit governments on three continents with SharePoint attacks
[13]Suspected Salt Typhoon snoops lurking in European telco's network
[14]Salt Typhoon used dozens of domains, going back five years. Did you visit one?
"Gordon Ramsay's feud with Marco Pierre White, Anakin's rise under Obi-Wan Kenobi, and Mao Zedong's study of communism under Chen Duxiu all fit the mold."
It should be said, and Cary acknowledged it himself, that there is nothing to suggest that Cisco or its academy cup played any direct role in the pair later working as cyberspies for Beijing.
"The program itself is not cause for concern, nor should participation in it be construed as such."
Cary said the findings suggest that any vendor offering local training in geopolitically unfriendly regions should be aware that knowledge of offensive capabilities is likely in enemy hands.
They also serve as a reminder that educational background is not a reliable predictor for workplace capability, and that offensive teams may benefit from sending their own people through similar training initiatives like Huawei's ICT academy.
"Only in hindsight, and with the story of Qiu and Yu, can security researchers now see how those efforts may have incidentally boosted offensive researchers," said Cary. "Microsoft's sharing of source code with the MSS has long been touted as a Faustian bargain by the security community.
"Education initiatives fall short of such acclaim, but may come to present more risk than return as the Chinese Communist Party remakes the country's computer networks with home-grown technology – as the Delete America document makes clear is their goal."
The Register contacted Cisco for a response. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.ncsc.gov.uk/news/uk-allies-expose-china-tech-companies-enabling-cyber-campaign
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/
[7] https://www.theregister.com/2025/02/13/salt_typhoon_pwned_7_more/
[8] https://www.theregister.com/2025/11/24/fcc_salt_typhoon_rules/
[9] https://www.theregister.com/2025/08/28/fbi_cyber_cop_salt_typhoon/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2025/11/24/fcc_salt_typhoon_rules/
[12] https://www.theregister.com/2025/10/22/salt_typhoon_sharepoint_attacks/
[13] https://www.theregister.com/2025/10/20/salt_typhoon_european_telco/
[14] https://www.theregister.com/2025/09/08/salt_typhoon_domains/
[15] https://whitepapers.theregister.com/
SentinelLabs' Dakota Cary linked Yu Yang and Qiu Daibing, two alleged members of the Chinese state hacking group, to participants of the 2012 Cisco Networking Academy Cup.
The initiative is still going today. It typically runs for a few months and is geared toward beginners learning foundational cybersecurity skills, which are then tested in competitions like capture the flag events.
[1]
Both Yu and Qiu are co-owners of Beijing Huanyu Tianqiong, one of the Chinese tech companies that international [2]security advisories specify as being fronts for Salt Typhoon activity.
[3]
[4]
Digging into their pasts, Cary found that Yu and Qiu represented Southwest Petroleum University in Cisco's academy cup in China. Yu's team placed second in the Sichuan region, while Qiu's team won it and later placed third nationally, despite the university not carrying a significant pedigree in academic excellence.
The researcher also noted the link between Yu and Qiu's participation in Cisco Networking Academy Cup, the training that came with it, and the products he says they later went on to exploit at Beijing's behest.
[5]
He [6]said : "The Cisco Networking Academy began in 1997 and entered China's market in 1998. Among the content covered in Cisco Networking Academy were many of the products Salt Typhoon exploited, including [7]Cisco IOS and ASA Firewalls ."
First publicized in 2024, international cyber agencies have since said that the expansive campaign carried out by Salt Typhoon led to compromises of at least 80 global telecoms companies.
Those attacks allowed China to snoop on secret communications between elected officials, US law enforcement's [8]CALEA requests, and more. The campaign remains one of the [9]most severe and sensitive cybersecurity breaches in US history.
[10]
"All of that high-tech novelty disguises a tale as old as time: skilled master trains apprentice, apprentice masters skills with tutelage, apprentice usurps the master owing to some core ideological difference between the two that festers over time," Cary said.
[11]FCC guts post-Salt Typhoon telco rules despite ongoing espionage risk
[12]Salt Typhoon hit governments on three continents with SharePoint attacks
[13]Suspected Salt Typhoon snoops lurking in European telco's network
[14]Salt Typhoon used dozens of domains, going back five years. Did you visit one?
"Gordon Ramsay's feud with Marco Pierre White, Anakin's rise under Obi-Wan Kenobi, and Mao Zedong's study of communism under Chen Duxiu all fit the mold."
It should be said, and Cary acknowledged it himself, that there is nothing to suggest that Cisco or its academy cup played any direct role in the pair later working as cyberspies for Beijing.
"The program itself is not cause for concern, nor should participation in it be construed as such."
Cary said the findings suggest that any vendor offering local training in geopolitically unfriendly regions should be aware that knowledge of offensive capabilities is likely in enemy hands.
They also serve as a reminder that educational background is not a reliable predictor for workplace capability, and that offensive teams may benefit from sending their own people through similar training initiatives like Huawei's ICT academy.
"Only in hindsight, and with the story of Qiu and Yu, can security researchers now see how those efforts may have incidentally boosted offensive researchers," said Cary. "Microsoft's sharing of source code with the MSS has long been touted as a Faustian bargain by the security community.
"Education initiatives fall short of such acclaim, but may come to present more risk than return as the Chinese Communist Party remakes the country's computer networks with home-grown technology – as the Delete America document makes clear is their goal."
The Register contacted Cisco for a response. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.ncsc.gov.uk/news/uk-allies-expose-china-tech-companies-enabling-cyber-campaign
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/
[7] https://www.theregister.com/2025/02/13/salt_typhoon_pwned_7_more/
[8] https://www.theregister.com/2025/11/24/fcc_salt_typhoon_rules/
[9] https://www.theregister.com/2025/08/28/fbi_cyber_cop_salt_typhoon/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aTr4pZUDMMRSFcaI87jyFwAAAVA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2025/11/24/fcc_salt_typhoon_rules/
[12] https://www.theregister.com/2025/10/22/salt_typhoon_sharepoint_attacks/
[13] https://www.theregister.com/2025/10/20/salt_typhoon_european_telco/
[14] https://www.theregister.com/2025/09/08/salt_typhoon_domains/
[15] https://whitepapers.theregister.com/
Security
Yet Another Anonymous coward
Fortunately being the foremost supplier of secure networking kit, Cisco's security doesn't rely purely on obscurity with only people attending their training being told where the secret back door is
Hah! Salt Typhoon and Cisco.............
Anonymous Coward
........a marriage made in heaven!!!!
........just needs NIST participants to make everything PERFECT!!!!
Spies like us?
ecofeco
Oh noes! The spize!
Not the hundreds of YouTube topics on how to reverse engineer almost anything. And I mean anything. Nope.
And certainly not the top-top, world class software Shitsco uses. No siree!
And in other news, water is wet
Furious Reg reader John
Who could have foreseen that network training courses might be something that people who use networks might attend.
Does SentinelLabs track US cyber spies?
Just wondering