FBI Says It Dismantled ‘Likely the World’s Largest Botnet’

U.S. federal law enforcement said Wednesday that an international law enforcement operation disrupted the 911 S5 botnet used to hack residential computers as proxies to commit fraud.

See Also: Guide to Strengthening Mainframe Security

According to FBI Director Christopher Wray, the bureau spearheaded a globally coordinated cyber operation to dismantle what is likely “the world’s largest botnet ever.” The alleged primary administrator of the malicious botnet service, 35-year-old Chinese national Yunhe Wang, was arrested Friday as part of the international operation.

The announcement comes a day after the U.S. Department of the Treasury sanctioned Wang for his role in directing the botnet, which consisted of 19 million IP addresses by the time it was dismantled (see: US Sanctions Chinese National for Running 911 S5 Botnet). The department’s Office of Foreign Assets Control said an investigation revealed the botnet was used to submit “tens of thousands of fraudulent applications” for coronavirus and economic stimulus funds and to anonymously spread bomb threats.

Wang, a Chinese national and St. Kitts and Nevis citizen-by-investment, is charged with deploying malware and creating and operating the residential proxy service. Treasury also sanctioned two other Chinese nationals, Jinping Liu and Yanni Zheng, who are accused of conspiring with Wang to launder money criminally derived funds into bank accounts to purchase luxury real estate, including a luxury beachfront condominium in Thailand.

U.S. Attorney General Merrick Garland said the botnet facilitated “cyberattacks, large-scale fraud, child exploitation, harassment, bomb threats and export violations.”

The botnet infected computers in nearly 200 countries including 613,841 IP addresses located in the U.S. According to the indictment, Wang criminally generated millions of dollars by offering access to the exploited devices for a fee.

Wang allegedly used virtual private networks such as MaskVPN and DewVPN to bundle his malware with other program files, eventually controlling approximately 150 dedicated servers across the globe.

“Wang created malware that compromised millions of residential computers around the world and then sold access to the infected computers to cybercriminals,” Principal Deputy Assistant Attorney General Nicole Argentieri, head of the Justice Department’s Criminal Division, said in a statement. “These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyberstalking.”

The FBI’s Dallas and Denver field offices, along with the Defense Criminal Investigative Service and the Department of Commerce, have been jointly investigating the botnet since it was reconstituted in October 2023, an FBI official told reporters on a Wednesday phone call about the U.S.-led operation. The 911 S5 botnet began operating in May 2014 and was taken offline by the administrator in July 2022 for a temporary period, according to the official.

The botnet was used “as an infrastructure highway for carrying out crimes,” the official said, including financial fraud, identity theft, child exploitation, initial access brokering and a series of bomb threats in July 2022, when U.S. campuses were experiencing a surge in such threats.

The FBI has set up a web page – www.FBI.gov/911S5 – for individuals to check whether or not their devices have been compromised. The page includes a step-by-step remediation process for victims.