From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence

According to SentinelLabs, the Salt Typhoon group began as Cisco Networking Academy competitors whose training was later weaponised to target global telecommunications infrastructure. First detected in September 2024, the campaign has penetrated over 80 telecommunications companies worldwide, harvesting unencrypted calls and text messages from high‑profile targets including U.S. presidential candidates and Washington experts.

The report notes that systems embedded in telecommunications companies for CALEA, which facilitates lawful intercept of criminals’ communications, were also breached by Salt Typhoon. The two individuals identified as behind the operation are Yuyang (余洋) and Qiu Daibing (邱代兵), co‑owners of Beijing Huanyu Tianqiong and Sichuan Zhixin Ruijie, who reportedly collaborated to file patents and orchestrate the attacks.

The investigation traces their path from students at Southwest Petroleum University to active co‑operators of the named companies, illustrating how training can translate into offensive capability. It also highlights a vulnerability in global tech education initiatives linked to the Cisco Network Academy’s reach, which entered China in 1998.