Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network Academy

Two key players in the notorious Salt Typhoon hacker group are former Cisco Network Academy trainees, according to researchers at SentinelLabs.

An investigation by the firm suggests Yu Yang and Qiu Daibing used their insider product knowledge to compromise telecoms systems in one of the largest intelligence-gathering operations of the decade.

Salt Typhoon collected unencrypted calls and texts between US presidential candidates, key staffers, and China experts.

The Cisco Network Academy began in 1997 and entered the Chinese market in 1998. It has now trained more than 200,000 students in China - most, of course, perfectly reputable.

Qiu and Yu were apparently top students at the 2012 Cisco Network Academy Cup, representing Southwest Petroleum University. However, a little sleuthing revealed that the pair are co-owners of Beijing Huanyu Tianqiong, with Yu also tied to Sichuan Zhixin Ruijie.

Both of these companies were named in a Salt Typhoon cybersecurity advisory by US authorities.

"Among the content covered in Cisco networking academy were many of the products Salt Typhoon exploited, including Cisco IOS and ASA firewalls," said Dakota Cary, a China-focused consultant at SentinelOne.

"Of course, a product training academy educating students on the company’s wares is hardly surprising. More notable is the fact that two students from a regional university, with limited recognition in IT and cybersecurity education participated in the Cisco Network Academy and went on to run one of the most expansive collection operations against global telecommunications firms ever detected and disclosed publicly."

Salt Typhoon has been on a rampage

Salt Typhoon has quickly emerged as one of the most notorious state-sponsored hacker groups globally. As ITPro reported last year, a campaign by the threat group saw it intercept unencrypted calls and texts from high-value US political targets dating back to 2019.

Targets in this campaign spanned a wide range of sectors, focusing mainly on large backbone routers of major telecommunications providers, as well as provider edge and customer edge routers.

The group is still active, with the US Department of Defense (DoD) revealing in July that Salt Typhoon had breached and laid low in the network of an unnamed US state National Guard for almost a year.

In September, the FBI warned that the group was ramping up attacks globally, having hit more than 60 organizations in 80 countries.

Education schemes could cause blowback

SentinelLabs said the unmasking of Qiu and Yu reveals the long-term security risks of global tech education pipelines, which can be exploited by state-linked operators.

"The episode suggests that offensive capabilities against foreign IT products likely emerge when companies begin supplying local training and that there is a potential risk of such education initiatives inadvertently boosting foreign offensive research," said Cary.

"Qiu and Yu are not an oddity; they are evidence of a world in which today’s students can become tomorrow’s rivals with little more than time, opportunity, and a different notion of whose security they serve."

A spokesperson for Cisco told ITPro the networking giant "remains committed to helping people around the world gain the foundational digital skills needed to access careers in technology".

“Cisco Networking Academy (NetAcad) is a skills-to-jobs program that teaches foundational technology skills and digital literacy, helping millions of students obtain basic certifications for entry-level IT jobs each year. This program is open to everyone," the spokesperson commented.

"Since its inception in 1997, the program has educated over 28 million students across 195 countries, in partnership with more than 12,000 institutions and organizations.

"In 2012, NetAcad hosted one global competition series called NetRiders and published a list of APAC regional winners."

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

• A new 'top-tier' Chinese espionage group is stealing sensitive data
• Chinese hackers are using ‘stealthy and resilient’ Brickstorm malware to hide in networks for months at a time
• China cyber threats: What businesses can do to protect themselves