FOLLOW US

Following an investigation by law enforcement in the U.S., Singapore, Thailand, and Germany, the U.S. Department of Justice announced on Wednesday the dismantling of a botnet used in cyberattacks, child exploitation, massive fraud, and export violations, and the arrest of YunHe Wang, a Chinese national behind the malware.

YunHe Wang, 35, who holds citizenship in St. Kitts and Nevis through investment, was arrested on May 24. He faces charges of conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering related to his role in creating and operating the botnet known as "911 S5," the DOJ revealed in a statement.

A botnet is a network of computers infected with malicious software, controlled without the owners' knowledge, to carry out malware attacks, steal data, send spam messages, and other illicit activities. According to an indictment unsealed on May 24, Wang and others created and disseminated malware from 2014 through July 2022, compromising millions of private Windows computers globally. The botnet affected over 19 million unique IP addresses, including nearly 615,000 in the U.S.

Prosecutors allege that Wang profited millions of dollars from hackers and other cybercriminals seeking access to the infected IP addresses. These addresses were then used to commit crimes, including bomb threats, stalking, illegal exportation of goods, child exploitation, and various financial crimes. The indictment states that since 2014, the perpetrators have stolen billions of dollars from financial institutions, credit card issuers, and federal lending programs, including pandemic relief efforts. The compromised IP addresses facilitated approximately 560,000 fraudulent unemployment claims, resulting in a loss exceeding $5.9 billion, according to the DOJ.

The botnet also enabled criminals outside the U.S. to use stolen credit cards or illicit funds to buy goods and illegally export them. Attorney General Merrick B. Garland emphasized that the DOJ will continue to pursue cybercriminals globally. FBI Director Christopher Wray added that the 911 S5 botnet, likely the world's largest, infected computers in nearly 200 countries, enabling various computer-enabled crimes, including fraud, identity theft, and child exploitation.

Wang propagated his malware through virtual private network programs and managed about 150 dedicated servers worldwide, including 76 leased from U.S.-based service providers. He used these servers to control infected devices, operate the botnet, and provide access to paying cybercriminals.