FBI dismantles cybercrime botnet of 19M infected computers

A Chinese national was charged Wednesday with leading the “world’s largest botnet,” responsible for “billions” in cybercrime, the Department of Justice (DOJ) announced Wednesday.

The DOJ said YunHe Wang used the botnet, named “911 S5,” to “commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations.”

“Working with our international partners, the FBI conducted a joint, sequenced cyber operation to dismantle the 911 S5 Botnet — likely the world’s largest botnet ever,” FBI Director Christopher Wray said in a statement. “The 911 S5 Botnet infected computers in nearly 200 countries and facilitated a whole host of computer-enabled crimes, including financial frauds, identity theft, and child exploitation.”

“This operation demonstrates the FBI’s commitment to working shoulder-to-shoulder with our partners to protect American businesses and the American people, and we will work tirelessly to unmask and arrest the cybercriminals who profit from this illegal activity,” he added.

The botnet contained more than 19 million computers, including more than 600,000 in the United States. Wang leased access to the computers to cybercriminals across the world for a profit, the DOJ said.

Prosecutors said Wang, who was arrested in Singapore last week, distributed his malware mostly through virtual private network services and through pirated media online. He also managed to gain access to about 150 major servers, including about 75 in the U.S., further spreading his botnet malware.

Criminals using the 911 S5 network are responsible for stealing billions from financial institutions, credit card issuers, and federal lending programs, the DOJ said. The network also targeted pandemic relief programs, filing at least 560,000 fraudulent unemployment claims at a cost of an estimated $5.9 billion.

The Biden administration said Wang himself profited nearly $100 million from the network’s operation via both traditional currency and cryptocurrency, which he invested in properties and assets worldwide. His assets included luxury homes in St. Kitts and Nevis and the United Arab Emirates, sports cars including a Ferrari and Rolls Royce, and other luxury goods.

“The conduct alleged here reads like it’s ripped from a screenplay: A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate,” Commerce Department Assistant Secretary Matthew Axelrod said. 

“What they don’t show in the movies though is the painstaking work it takes by domestic and international law enforcement, working closely with industry partners, to take down such a brazen scheme and make an arrest like this happen,” he added.

Wang is charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. If convicted on all counts, he could face a maximum penalty of 65 years in prison.

In its announcement of the arrest, the DOJ noted special thanks to the governments of Singapore and Thailand for cooperating in the investigation.