Loading story…
Two individuals associated with the Chinese state-sponsored hacking group Salt Typhoon were identified as former participants in the Cisco Networking Academy, raising concerns about the unintended consequences of global IT training programs. These individuals, Yuyang and Qiu Daibing, later became co-owners of companies implicated in Salt Typhoon's operations, which targeted Cisco devices and exploited vulnerabilities to conduct extensive cyberespionage campaigns against Western targets, including U.S. presidential candidates and telecommunications infrastructure.
Salt Typhoon's campaign, first publicly reported in September 2024, compromised over 80 telecommunications companies worldwide, enabling the interception of unencrypted calls, texts, and even breaching lawful intercept (CALEA) systems. The operation highlights the risk that foreign training initiatives may inadvertently enhance the offensive cyber capabilities of adversarial states, especially as China moves to reduce reliance on American-made IT products. U.S. government advisories have warned about Salt Typhoon's sophisticated exploitation of Cisco vulnerabilities to obtain credentials and move laterally within targeted networks.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Reporting and research published in December 2025 tied Yu Yang and Qiu Daibing to Salt Typhoon, connecting their later roles in companies linked to the group with their earlier Cisco Academy participation. The findings highlighted how technical product training may have supported later offensive tradecraft.
A US government cybersecurity advisory identified companies, including Beijing Huanyu Tianqiong, as fronts or entities connected to Salt Typhoon's cyber operations. Yu Yang and Qiu Daibing were described as partial or co-owners of companies named in that advisory.
During the telecom intrusions, Salt Typhoon accessed CALEA lawful intercept systems and intercepted unencrypted communications, including those involving US presidential candidates and Washington, DC China experts.
Salt Typhoon conducted a large-scale espionage campaign that breached at least 80 telecommunications companies globally. The intrusions enabled intelligence collection against sensitive telecom infrastructure and Cisco devices.
The Chinese state-linked espionage group Salt Typhoon was first publicly reported in September 2024, marking the start of public awareness of the campaign.
Records cited by researchers indicate Yu Yang and Qiu Daibing participated as top-performing students in the 2012 Cisco Networking Academy Cup in China, receiving hands-on training with Cisco technologies later central to their alleged operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcecybersecuritynews.com
Open sourcewired.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Salt Typhoon, a threat group linked to the People’s Republic of China, conducted a multiyear cyber espionage campaign targeting major U.S. telecom providers such as Verizon, AT&T, and T-Mobile, compromising the data of hundreds of millions of users. The campaign is considered by U.S. officials to be the most significant cyber espionage operation in history, with attackers gaining access to sensitive information including call logs, unencrypted texts, and audio from high-ranking political figures, as well as targeting law enforcement intercept backdoors and military networks. The group’s activities have raised concerns about potential election interference, political blackmail, and threats to national security. Salt Typhoon exploited unpatched, end-of-life, and forgotten network perimeter devices—such as routers, VPNs, and firewalls—using sophisticated “living off the land” tactics to establish long-term persistence and evade detection. The attackers stole administrator credentials, network traffic diagrams, and personal information from military and state cybersecurity personnel, using this intelligence to fuel further intrusions. The campaign highlights the urgent need for organizations to address technical debt and proactively secure legacy infrastructure, as reactive patching cannot undo compromises on already breached devices.
Jul 12, 2026
U.S. officials and cybersecurity experts have highlighted the ongoing threat posed by nation-state actors, particularly the Chinese-linked group known as Salt Typhoon, which has conducted widespread cyber intrusions targeting critical American infrastructure. These campaigns have focused on stealing intellectual property, surveilling government officials, and pre-positioning within essential networks such as airports, hospitals, water treatment facilities, and telecom providers, with the intent to disrupt services or gather intelligence at a time of their choosing. The persistence and sophistication of these operations underscore the urgent need for coordinated defense efforts between government agencies and the private sector, as most critical infrastructure is privately owned or operated. Recent incidents attributed to Salt Typhoon include the compromise of multiple U.S. telecom networks, with attackers maintaining access for nearly a year before detection. These breaches exemplify the evolving nature of hybrid and cross-domain threats, where cyber intrusions can cascade into physical and reputational risks. Security leaders are being urged to adopt new, asymmetric approaches to risk management, breaking down traditional silos and ensuring that intelligence and response capabilities keep pace with the rapidly changing threat landscape.
Jul 12, 2026
Salt Typhoon, a China-linked advanced persistent threat (APT) group, conducted a sophisticated cyber espionage campaign targeting a European telecommunications organization. The attackers gained initial access by exploiting a Citrix NetScaler Gateway appliance, then moved laterally to internal Citrix Virtual Delivery Agent hosts. They used DLL sideloading via legitimate antivirus software to deploy the SNAPPYBEE (Deed RAT) backdoor, leveraging LightNode VPS endpoints and non-standard protocols for command-and-control to evade detection. The operation was detected by Darktrace and highlights the group’s focus on intelligence collection and geopolitical influence across critical infrastructure sectors. Security experts emphasize the evolving tactics, techniques, and procedures (TTPs) of Salt Typhoon, including the exploitation of zero-day vulnerabilities and outdated infrastructure. The incident underscores the challenges of defending public-facing appliances and the importance of robust network visibility and proactive threat detection. Organizations in telecommunications and other critical sectors are urged to strengthen their defenses against state-sponsored threats by improving monitoring, patch management, and incident response capabilities.
Jun 29, 2026