Current:Home > MyTrendPulse|Feds take down one of world's largest malicious botnets and arrest its administrator -CapitalEdge
TrendPulse|Feds take down one of world's largest malicious botnets and arrest its administrator
Burley Garcia View
Date:2025-04-09 11:26:10
Washington — Federal investigators took down one of the world's largest malicious botnets,TrendPulse one that helped generate tens of thousands of fraudulent transactions that cost victims billions — including many related to COVID relief funding.
Law enforcement also arrested the botnet's administrator, YunHe Wang, a Chinese national. He's been accused of orchestrating an international plot to deploy malware and surreptitiously sell access to the infected computers' IP addresses. IP addresses, a string of numbers and dots, act as unique identifiers for the devices and domains on the internet, allowing them to communicate with each other and send information back and forth.
Wang is charged with leading an operation — known as the 911 S5 Botnet — that deployed 19 million compromised IP addresses in over 190 countries, using them as "an infrastructure highway for carrying out crimes such as bomb threats, financial fraud, identity theft, child exploitation, initial access brokering, and many other computer crimes," according to FBI cyber division deputy assistant director Brett Leatherman.
Officials confirmed Wang was financially motivated, with no known direct ties to nation-states.
Wang allegedly purchased $30 million in property in the U.S., St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates, and paid over $4 million for luxury items including a BMW, Rolls Royce and several watches, according to court documents.
More than 600,000 of the IP addresses were in the U.S. Wang was arrested on Friday and charged in a four-count indictment including conspiracy and computer fraud.
According to court papers, Wang allegedly sold his unsuspecting victims various Virtual Private Network (VPN) programs.
VPN extensions are routinely used to encrypt an internet connection, routing it through a remote server to mask an IP address and hide the user's browsing history and location.
In this case, these VPN programs installed malicious software on the computers when downloaded, secretly allowing their IP addresses to be coopted remotely. Investigators said Wang then doled out the stolen IP addresses to cybercriminals for millions of dollars to facilitate the illicit activity.
By operating under the guise of the victims' IP addresses, cybercriminals could carry out their schemes and avoid detection by law enforcement. In some cases, according to prosecutors, Wang even sold access to the IP addresses based on the particular geographic needs of the criminals.
Leatherman warned that malicious VPN services downloaded included Mask VPN, Dew VPN, Paladin VPN, Proxy Gate, Shield VPN and Shine VPN.
"Cybercriminals have used the 911 S5 service to bypass financial fraud detection systems in the United States and elsewhere and have successfully stolen billions of dollars from financial institutions, credit card issuers and account holders, and federal lending programs since 2014," according to charging documents. In one instance, prosecutors said more than $5.9 billion in potential pandemic relief fraud losses were tied to IP addresses "exploited and trafficked" by Wang's botnet.
Investigators said a key aspect of the growing network of infected computers was Wang and his co-conspirators' ability to infect victims without their knowledge and bypass software that usually detects viruses.
In all, prosecutors said Wang allegedly made more than $99 million from his sales of the hijacked IP addresses and worked with others to launder some of his proceeds through U.S. banks.
"The majority of the fraud came from fraudulent pandemic relief fund applications," said Leatherman. "That is a significant theft against Americans who in very difficult times were looking for financial relief related to the pandemic."
"There's an entire ecosystem, which enables the activities of cyber criminals from Bitcoin to elder fraud to ransomware, and illicit conduct from nation states," he added.
"Working with our international partners, the FBI conducted a joint, sequenced cyber operation to dismantle the 911 S5 Botnet—likely the world's largest botnet ever," FBI Director Christopher Wray said in a statement Wednesday.
FBI officials said both Singapore and Thailand's authorities were "critical" to Wang's arrest after they conducted searches and interviews and seized assets. U.S. officials are working with Singapore's government to extradite him to the U.S.
Law enforcement seized 23 domains and over 70 servers, dismantling a network of infected devices that investigators say Wang and co-conspirators constructed from 2014 to 2022.
"You can never guarantee 100% dismantlement of these networks, but taking him into custody also serves as a key milestone for us," noted Leatherman. "The investigation is not over," he added. "Through physical search warrants, conducting interviews and seizures, we will hopefully identify artifacts and evidence which lead us to other individuals who use that service to target innocent American individuals and corporations."
An attorney for Wang could not be immediately identified.
The FBI has created a webpage to allow potential victims to determine if their device has been compromised, and lead them through a self-remediation process.
Robert LegareRobert Legare is a CBS News multiplatform reporter and producer covering the Justice Department, federal courts and investigations. He was previously an associate producer for the "CBS Evening News with Norah O'Donnell."
veryGood! (22)
Related
- FACT FOCUS: Inspector general’s Jan. 6 report misrepresented as proof of FBI setup
- National Amusements ends Paramount merger talks with Skydance Media
- Queer and compelling: 11 LGBTQ+ books for Pride you should be reading right now
- Do you regret that last purchase via social media? You're certainly not alone.
- Elon Musk's skyrocketing net worth: He's the first person with over $400 billion
- Former Trump attorney in Wisconsin suspended from state judicial ethics panel
- 4 Cornell College instructors wounded in stabbing attack in China; suspect arrested
- Off the Grid: Sally breaks down USA TODAY's daily crossword puzzle, Flip Side
- Meta donates $1 million to Trump’s inauguration fund
- NBA Finals Game 3 Celtics vs. Mavericks: Predictions, betting odds
Ranking
- Nearly 400 USAID contract employees laid off in wake of Trump's 'stop work' order
- Jay-Z’s Roc Nation to drum up support for private school vouchers in Philadelphia
- Trump’s company: New Jersey golf club liquor license probe doesn’t apply to ex-president
- Banana company to pay millions over human rights abuses
- B.A. Parker is learning the banjo
- Sam Brown, Jacky Rosen win Nevada Senate primaries to set up November matchup
- The Daily Money: Is inflation taming our spending?
- Bill for “forever chemicals” manufacturers to pay North Carolina water systems advances
Recommendation
Whoopi Goldberg is delightfully vile as Miss Hannigan in ‘Annie’ stage return
The US cricket team is closing in on a major achievement at the Twenty20 World Cup
Tiger Woods feeling at home with 'hot, humid' conditions at US Open
Six years after the Parkland school massacre, the bloodstained building will finally be demolished
Louvre will undergo expansion and restoration project, Macron says
Man accused of hijacking bus in Atlanta charged with murder, other crimes
Who is Tony Evans? Pastor who stepped down from church over ‘sin’ committed years ago
Krispy Kreme unveils new doughnut collection for Father's Day: See new flavors