Researchers at the Canadian University of Sherbrooke revealed almost two years ago, in June 2022, that this illegitimate residential proxy service lured potential victims by offering free VPN services to install malware designed to add their IP addresses to the 911 S5 botnet.
At the time, the botnet controlled approximately 120,000 residential proxy nodes from all over the world, all of which communicated with multiple command-and-control servers located offshore or hosted within a cloud server.
OFAC added that the residential proxy botnet compromised approximately 19 million IP addresses.
These infected devices allowed cybercriminals to submit tens of thousands of fraudulent applications for programs related to the Coronavirus Aid, Relief, and Economic Security Act, resulting in billions of dollars in losses.
911 S5 users also used it to commit widespread cyber-enabled fraud using residential IP addresses linked to compromised computers.
These IP addresses were also used in a series of bomb threats made across the United States in July 2022.
OFAC today sanctioned Yunhe Wang, Jingping Liu, and Yanni Zheng, as well as three entities, all owned or controlled by Yunhe Wang.
As a result of today's sanctions, all transactions involving U.S. interests and properties of designated individuals and entities are prohibited, and dealings with sanctioned individuals and companies also expose them to sanctions or enforcement actions.
Cybersecurity firm Mandiant also warned last week that Chinese state hackers are increasingly relying on vast proxy server networks built from compromised online devices and virtual private servers to evade detection during their cyberespionage campaigns.
State hackers turn to massive ORB proxy networks to evade detection.
US woman allegedly aided North Korean IT workers infiltrate 300 firms.
US govt sanctions Iranians linked to government cyberattacks.
Moldovan charged for operating botnet used to push ransomware.
CISA orders agencies impacted by Microsoft hack to mitigate risks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 28 May 2024 19:05:14 +0000