The U.S. Justice Department and international partners dismantled the 911 S5 proxy botnet and arrested 35-year-old Chinese national YunHe Wang, its administrator.
As early as 2011, Wang and his conspirators pushed malware onto victims' devices using multiple malicious VPN applications bundling proxy backdoors.
The VPN apps that added compromised devices to the 911 S5 residential proxy service include MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN. Between 2014 and July 2022, they created a network of millions of residential Windows computers worldwide linked to more than 19 million unique IP addresses, including 613,841 IP addresses in the United States.
Researchers at the University of Sherbrooke revealed in June 2022 that the 911 S5 operators lured potential victims by offering free VPN services to install the proxy malware.
The Justice Department is now serving seizure warrants to registrars and registry entities to seize the following domains used by the criminal network.
Wang collected approximately $99 million by selling access to the proxied IP addresses to cybercriminals for a fee.
The criminals used the compromised devices' Internet connections for a wide range of crimes, including cyber attacks, bomb threats, child exploitation, large-scale fraud, harassment, and export violations.
911 S5 customers also used the illegitimate residential proxy service to submit tens of thousands of fraudulent applications for programs related to the Coronavirus Aid, Relief, and Economic Security Act, 560,000 fraudulent unemployment insurance claims, and over 47,000 Economic Injury Disaster Loan applications, resulting in billions of dollars stolen from financial institutions, credit card issuers, and federal lending programs.
On Tuesday, the U.S. Treasury Department also sanctioned Wang, Jingping Liu, and Yanni Zheng, and three entities that were either owned or controlled by Wang.
Wang faces a maximum penalty of 65 years in prison if convicted on all counts, including conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering.
US govt sanctions cybercrime gang behind massive 911 S5 botnet.
State hackers turn to massive ORB proxy networks to evade detection.
Botnet sent millions of emails in LockBit Black ransomware campaign.
Ebury botnet malware infected 400,000 Linux servers since 2009.
Moldovan charged for operating botnet used to push ransomware.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 29 May 2024 17:15:04 +0000