China’s Salt Typhoon Hacker Group: Cisco Academy Training Link Exposed
- Security researcher Cary, whose full name was not provided in the source material, suggests a potential connection between two individuals - qiu Daibing and Yu Yang - and...
- The name Yu Yang (余洋 in Chinese characters) is a relatively common one.
- Cary's theory centers on the possibility that both Qiu Daibing and Yu Yang received training at Cisco's Networking Academy.
Potential Links Between Chinese Hackers and Cisco Networking Training Raise Security Concerns
Table of Contents
Published December 10, 2025, 20:19:58 PST
The Salt Typhoon Connection
Security researcher Cary, whose full name was not provided in the source material, suggests a potential connection between two individuals – qiu Daibing and Yu Yang – and the hacking group known as Salt Typhoon. Salt typhoon has been implicated in cyberattacks targeting organizations in Japan and the United States, often focusing on telecommunications and defense industries. Wired reported on these attacks in November 2023, detailing the group’s sophisticated tactics.
The name Yu Yang (余洋 in Chinese characters) is a relatively common one. However, Cary believes the convergence of the name, a shared skillset, and attendance at the same university in the same location as the companies registered to these individuals is statistically improbable, suggesting they are likely the individuals linked to Salt Typhoon.
Cisco Networking Academy Training
Cary’s theory centers on the possibility that both Qiu Daibing and Yu Yang received training at Cisco’s Networking Academy. This program provides globally recognized certifications in networking technologies. Cisco Networking Academy offers courses in various networking fields, from introductory IT skills to advanced cybersecurity.
Cary emphasizes that this potential link doesn’t indicate a security flaw within Cisco’s program. Instead, it highlights the inherent challenge of widespread technology availability, including training materials, to potential adversaries. The accessibility of these resources globally makes it tough to prevent malicious actors from acquiring valuable technical knowledge.
China’s Shifting Tech Landscape and Cybersecurity Concerns
The situation is further complicated by China’s ongoing efforts to replace Cisco equipment and othre Western technologies wiht domestically produced alternatives. Reuters reported in December 2022 on China’s push to remove foreign technology from critical infrastructure.
cary poses a critical question: if China is actively removing Western technology from its networks, why would individuals within the country still be interested in learning about it? This raises concerns about the potential use of this knowledge for offensive cyber operations.
Limited Details Sharing
John Hultquist, chief analyst at Google’s Threat Intelligence Group, points to a growing trend of restricted information sharing from China within the global cybersecurity community. Google’s Threat analysis Group published a detailed report on Salt Typhoon in February 2024, outlining their tactics and attribution.
hultquist describes the situation as a one-sided exchange, stating, “It’s like we’re in a sharing group, and they’ve told us straight to our face that they’re not going to reciprocate.” he argues that Western cybersecurity programs are benefiting China without a corresponding exchange of information, hindering global efforts to combat cyber threats.
Implications and Future Outlook
The potential connection between Salt Typhoon members and Cisco Networking Academy training underscores the complex challenges of cybersecurity in a globalized world. The accessibility of technical knowledge, coupled with limited information sharing from key actors, creates an habitat where malicious cyber activity can flourish.
Moving forward, increased international cooperation and a more balanced approach to information sharing will be crucial to mitigating these risks. Further investigation into the backgrounds of individuals linked to Salt Typhoon and their training history is also warranted.