Following an investigation by law enforcement in the U.S., Singapore, Thailand, and Germany, the U.S. Department of Justice announced on Wednesday the dismantling of a botnet used in cyberattacks, child exploitation, massive fraud, and export violations, and the arrest of YunHe Wang, a Chinese national behind the malware.

YunHe Wang, 35, who holds citizenship in St. Kitts and Nevis through investment, was arrested on May 24. He faces charges of conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering related to his role in creating and operating the botnet known as "911 S5," the DOJ revealed in a statement.

A botnet is a network of computers infected with malicious software, controlled without the owners' knowledge, to carry out malware attacks, steal data, send spam messages, and other illicit activities. According to an indictment unsealed on May 24, Wang and others created and disseminated malware from 2014 through July 2022, compromising millions of private Windows computers globally. The botnet affected over 19 million unique IP addresses, including nearly 615,000 in the U.S.

Prosecutors allege that Wang profited millions of dollars from hackers and other cybercriminals seeking access to the infected IP addresses. These addresses were then used to commit crimes, including bomb threats, stalking, illegal exportation of goods, child exploitation, and various financial crimes. The indictment states that since 2014, the perpetrators have stolen billions of dollars from financial institutions, credit card issuers, and federal lending programs, including pandemic relief efforts. The compromised IP addresses facilitated approximately 560,000 fraudulent unemployment claims, resulting in a loss exceeding $5.9 billion, according to the DOJ.

The botnet also enabled criminals outside the U.S. to use stolen credit cards or illicit funds to buy goods and illegally export them. Attorney General Merrick B. Garland emphasized that the DOJ will continue to pursue cybercriminals globally. FBI Director Christopher Wray added that the 911 S5 botnet, likely the world's largest, infected computers in nearly 200 countries, enabling various computer-enabled crimes, including fraud, identity theft, and child exploitation.

Wang propagated his malware through virtual private network programs and managed about 150 dedicated servers worldwide, including 76 leased from U.S.-based service providers. He used these servers to control infected devices, operate the botnet, and provide access to paying cybercriminals.

From 2018 to July 2022, Wang received approximately $99 million in cryptocurrency or fiat currency from selling the hijacked IP addresses. He used these proceeds to purchase properties in the U.S., St. Kitts and Nevis, China, Singapore, Thailand, and the UAE, along with luxury cars and wristwatches. Prosecutors noted that Wang controlled more than a dozen domestic and international bank accounts and over two dozen cryptocurrency wallets.

The investigation into 911 S5 began during a money laundering and smuggling scheme probe involving criminals in Ghana and the U.S. using hijacked IP addresses to place fraudulent orders on the Army and Air Force Exchange Service online platform.

If convicted on all counts, Wang faces up to 65 years in prison. U.S. Attorney Damien M. Diggs for the Eastern District of Texas stated that Wang would be held accountable for creating and administering the 911 S5 botnet. Diggs highlighted the importance of strong collaboration and exceptional investigative work between domestic and international law enforcement partners.

On Tuesday, the U.S. Department of the Treasury's Office of Foreign Assets Control imposed sanctions on Wang and his associates, Jingping Liu and Yanni Zheng, related to the botnet and its involvement in fraudulent pandemic relief applications and a series of bomb threats in the U.S. in July 2022. Treasury Under Secretary for Terrorism and Financial Intelligence Brian E. Nelson condemned their actions and emphasized the ongoing efforts to disrupt cybercriminals and protect U.S. taxpayers.

The government is represented by Candy Heath and Lydia Lichlyter of the DOJ's Criminal Division, Computer Crime and Intellectual Property Section, and Camelia Lopez and William Tatum of the U.S. Attorney's Office for the Eastern District of Texas. Counsel information for Wang was not immediately available.

The case is U.S. v. YunHe Wang, case number 4:23-cr-00101, in the U.S. District Court for the Eastern District of Texas.