2 men linked to the Chinese hacker group Salt Typhoon probably trained in a Cisco “academy”
To try to determine the likelihood that these name repetitions were a coincidence, Cary checked two databases of Chinese names and consulted Yi Fuxian, a professor of Chinese demography at the University of Wisconsin-Madison. The name Qiu Daibing – or 邱代兵 in Chinese characters – turned out to be a relatively unlikely name that would appear twice by chance, he says. The surname 邱 alone, Yi confirmed to WIRED, makes up just 0.27 percent of Chinese names, and in combination with the specific first name 代兵, it would make up a much smaller percentage.
The name Yu Yang (余洋 in Chinese characters) is more common. But the two names appearing in association seem less likely to be a coincidence, Cary theorizes. “The sheer improbability that someone with that name would also be associated with a Yu Yang, have those skills, and attend the same university in the same place where these companies are registered, it’s just an incredibly small chance that they’re not the right people,” Cary says.
WIRED attempted to contact Qiu Daibing and Yu Yang through Qiu Daibing’s LinkedIn page and an email address on the Beijing Huanyu Tianqiong website, but received no response.
If Cary’s theory that two men linked to Salt Typhoon were in fact trained at Cisco’s Networking Academy is correct, it does not represent a security flaw or oversight in Cisco’s program, he says. Instead, it highlights a problem that is difficult to avoid in a globalized market where technology products – and even training in the technical details of those products – are widely available, including to would-be hackers.
Cary says the problem has become even more acute as China has tried for years to replace Cisco equipment and other Western devices in its own networks with domestic alternatives. “If China is moving toward removing these products from Chinese networks,” Cary asks, “who is still interested in learning about them?”
Meanwhile, China has increasingly restricted its own information sharing with the global cybersecurity community, says John Hultquist, chief analyst at Google’s Threat Intelligence Group, for example, by pressuring security researchers not to present their findings at international conferences.
“It’s like we were in a sharing group, and they told us right to our face that they weren’t going to reciprocate,” Hultquist says. “We make them benefit from our programs. But it doesn’t go the other way.”
