DOJ Arrests Yunhe Wang for $130M IP Address Scam

The U.S. DOJ arrests Yunhe Wang for his crime of stealing over 19 million IP addresses to sell to other criminals.

A 35-year-old national of the People’s Republic of China and citizen-by-investment of St. Kitts and Nevis, Yune Wang, was arrested by the U.S. Department of Justice (DOJ) on suspicion of involvement in a botnet scam “used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations.”

Wang allegedly “created and disseminated malware to compromise and amass a network of millions of residential Windows computers worldwide” that impacted more than 19 million IP addresses via the 911 S5 botnet between 2014 and 2022, as stated in the indictment dated May 29. The defendant subsequently engaged in the sale of compromised IP addresses to cybercriminals in exchange for cryptocurrencies. These cybercriminals targeted victims in over 200 countries and orchestrated a multitude of computer-enabled offenses, such as identity theft, financial fraud, and child exploitation.

An additional examination conducted by Chainlysis, a firm specializing in blockchain analytics, reveals that wallet addresses linked to Wang collectively possessed more than $130 million worth of digital assets acquired via illegitimate commissions. Scientists from Chainalysis composed:

“The 911 S5 botnet was able to provide these services by distributing deceptive free VPN services to victims, which purported to give users enhanced privacy while browsing the web. In reality, 911 S5 used backdoors in its code to illegally hijack the IP addresses of millions of victims around the world. This enabled the 911 S5 administrators to make millions of dollars per year with a subscription-based service allowing cybercriminals to use victims’ IP addresses.”

In the interim, DOJ law enforcement officials added:

“911 S5 customers allegedly targeted certain pandemic relief programs. For example, the United States estimates that 560,000 fraudulent unemployment insurance claims originated from compromised IP addresses, resulting in a confirmed fraudulent loss exceeding $5.9 billion.”

Wang’s operational infrastructure consisted of 23 domains and 70 servers, which were collectively seized by law enforcement officials from the United States, Singapore, Thailand, and Germany in a concerted effort. Additionally, police claim to have seized $30 million in assets associated with 911 S5.

According to a report by Cointelegraph last month, China is purportedly employing application-specific integrated circuit mining devices that are domestically manufactured to infiltrate the Bitcoin mining infrastructure of the United States. According to an authority, the rigs facilitate cyber espionage by Chinese intelligence agencies, which may target sensitive military installations, power systems, or communication networks.