Wang propagated his malware through virtual private network programs and managed about 150 dedicated servers worldwide, including 76 leased from U.S.-based service providers. He used these servers to control infected devices, operate the botnet, and provide access to paying cybercriminals.
From 2018 to July 2022, Wang received approximately $99 million in cryptocurrency or fiat currency from selling the hijacked IP addresses. He used these proceeds to purchase properties in the U.S., St. Kitts and Nevis, China, Singapore, Thailand, and the UAE, along with luxury cars and wristwatches. Prosecutors noted that Wang controlled more than a dozen domestic and international bank accounts and over two dozen cryptocurrency wallets.
The investigation into 911 S5 began during a money laundering and smuggling scheme probe involving criminals in Ghana and the U.S. using hijacked IP addresses to place fraudulent orders on the Army and Air Force Exchange Service online platform.
If convicted on all counts, Wang faces up to 65 years in prison. U.S. Attorney Damien M. Diggs for the Eastern District of Texas stated that Wang would be held accountable for creating and administering the 911 S5 botnet. Diggs highlighted the importance of strong collaboration and exceptional investigative work between domestic and international law enforcement partners.
