Salt Typhoon pair attended Cisco cyber school, expert claims

"SentinelLabs' Dakota Cary linked Yu Yang and Qiu Daibing, two alleged members of the Chinese state hacking group, to participants of the 2012 Cisco Networking Academy Cup. The initiative is still going today. It typically runs for a few months and is geared toward beginners learning foundational cybersecurity skills, which are then tested in competitions like capture the flag events."

"First publicized in 2024, international cyber agencies have since said that the expansive campaign carried out by Salt Typhoon led to compromises of at least 80 global telecoms companies. Those attacks allowed China to snoop on secret communications between elected officials, US law enforcement's CALEA requests, and more. The campaign remains one of the most severe and sensitive cybersecurity breaches in US history."

Security researcher Dakota Cary connected two alleged Salt Typhoon members, Yu Yang and Qiu Daibing, to participation in the 2012 Cisco Networking Academy Cup. The academy provides months-long beginner cybersecurity training and competitive exercises such as capture-the-flag events. Yu and Qiu represented Southwest Petroleum University, placing highly in regional and national rounds. Both later became co-owners of Beijing Huanyu Tianqiong, a firm flagged by international advisories as a Salt Typhoon front. Cisco products taught in the academy, including IOS and ASA firewalls, match technologies the group later exploited. Salt Typhoon’s campaign compromised at least 80 global telecoms and exposed highly sensitive communications.

Read at Theregister