The U.S. Division of Justice (DOJ) in the present day mentioned they arrested the alleged operator of 911 S5, a ten-year-old on-line anonymity service that was powered by what the director of the FBI referred to as “doubtless the world’s largest botnet ever.” The arrest coincided with the seizure of the 911 S5 web site and supporting infrastructure, which the federal government says turned computer systems working varied “free VPN” merchandise into Web site visitors relays that facilitated billions of {dollars} in on-line fraud and cybercrime.
The Cloud Router homepage, which was seized by the FBI this previous weekend. Cloud Router was beforehand referred to as 911 S5.
On Could 24, authorities in Singapore arrested the alleged creator and operator of 911 S5, a 35-year-old Chinese language nationwide named YunHe Wang. In an announcement on his arrest in the present day, the DOJ mentioned 911 S5 enabled cybercriminals to bypass monetary fraud detection techniques and steal billions of {dollars} from monetary establishments, bank card issuers, and federal lending applications.
For instance, the federal government estimates that 560,000 fraudulent unemployment insurance coverage claims originated from compromised Web addresses, leading to a confirmed fraudulent loss exceeding $5.9 billion.
“Moreover, in evaluating suspected fraud loss to the Financial Harm Catastrophe Mortgage (EIDL) program, the USA estimates that greater than 47,000 EIDL purposes originated from IP addresses compromised by 911 S5,” the DOJ wrote. “Hundreds of thousands of {dollars} extra have been equally recognized by monetary establishments in the USA as loss originating from IP addresses compromised by 911 S5.”
From 2015 to July 2022, 911 S5 offered entry to tons of of 1000’s of Microsoft Home windows computer systems day by day, as “proxies” that allowed prospects to route their Web site visitors via PCs in just about any nation or metropolis across the globe — however predominantly in the USA.
911 S5 constructed its proxy community primarily by providing “free” digital personal networking (VPN) providers. 911’s VPN carried out largely as marketed for the person — permitting them to surf the net anonymously — but it surely additionally quietly turned the person’s pc right into a site visitors relay for paying 911 S5 prospects.
911 S5’s reliability and intensely low costs shortly made it one of the vital fashionable providers amongst denizens of the cybercrime underground, and the service grew to become virtually shorthand for connecting to that “final mile” of cybercrime. Specifically, the power to route one’s malicious site visitors via a pc that’s geographically near the buyer whose stolen bank card is about for use, or whose checking account is about to be emptied.
![](https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices.png)
The costs web page for 911 S5, circa July 2022. $28 would let customers cycle via 150 proxies on this fashionable service.
KrebsOnSecurity first recognized Mr. Wang because the proprietor of the favored service in a deep dive on 911 S5 printed in July 2022. That story confirmed that 911 S5 had a historical past of paying folks to put in its software program by secretly bundling it with different software program — together with pretend safety updates for frequent applications like Flash Participant, and “cracked” or pirated business software program distributed on file-sharing networks.
Ten days later, 911 S5 closed up store, claiming it had been hacked. However specialists quickly tracked the reemergence of the proxy community by one other identify: Cloud Router.
The announcement of Wang’s arrest got here lower than 24 hours after the U.S. Division of the Treasury sanctioned Wang and two associates, in addition to a number of firms the boys allegedly used to launder the practically $100 million in proceeds from 911 S5 and Cloud Router prospects.
Cloud Router’s homepage now incorporates a discover saying the area has been seized by the U.S. authorities. As well as, the DOJ says it labored with authorities in Singapore, Thailand and Germany to look residences tied to the defendant, and seized roughly $30 million in property.
![](https://krebsonsecurity.com/wp-content/uploads/2024/05/cloudrouterseized.png)
The Cloud Router homepage now incorporates a seizure discover from the FBI in a number of languages.
These property included a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, greater than a dozen home and worldwide financial institution accounts, over two dozen cryptocurrency wallets, a number of luxurious wristwatches, and 21 residential or funding properties.
The federal government says Wang is charged with conspiracy to commit pc fraud, substantive pc fraud, conspiracy to commit wire fraud, and conspiracy to commit cash laundering. If convicted on all counts, he faces a most penalty of 65 years in jail.
Brett Leatherman, deputy assistant director of the FBI’s Cyber Division, mentioned the DOJ is working with the Singaporean authorities on extraditing Wang to face prices in the USA.
Leatherman inspired Web customers to go to a brand new FBI webpage that may assist folks decide whether or not their computer systems could also be a part of the 911 S5 botnet, which the federal government says spanned greater than 19 million particular person computer systems in at the very least 190 international locations.
Leatherman mentioned 911 S5 and Cloud Router used a number of “free VPN” manufacturers to lure shoppers into putting in the proxy service, together with MaskVPN, DewVPN, PaladinVPN, Proxygate, Defend VPN, and ShineVPN.
“Americans who didn’t know that their IP area was being utilized to assault US companies or defraud the U.S. authorities, they have been unaware,” Leatherman mentioned. “However these type of operations breed that consciousness.”