Chinese national arrested for operating proxy service linked to billions in cybercrime | CyberScoop<\/title> <meta name=\"description\" content=\"YunHe Wang and two associates were also sanctioned by the Treasury Department in operation to install malware on users\u2019 computers.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/yunhe-wang-911s5-proxy-arrested\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Chinese national arrested for operating proxy service linked to billions in cybercrime \"> <meta property=\"og:description\" content=\"YunHe Wang and two associates were also sanctioned by the Treasury Department in operation to install malware on users\u2019 computers.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/yunhe-wang-911s5-proxy-arrested\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-05-29T19:15:22+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1715117951g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1715115084g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1716385020g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=74528d75ce0daeb8628a\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/80584\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.5.3\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=80584\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fyunhe-wang-911s5-proxy-arrested%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fyunhe-wang-911s5-proxy-arrested%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-80584 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/yunhe-wang-911s5-proxy-arrested\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.061428571429\">\n<div class=\"single-article__header-content\" readability=\"30.56976744186\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> YunHe Wang and two associates were also sanctioned by the Treasury Department in operation to install malware on users\u2019 computers. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> Global communication network on a glowing particle world map. (Yuichiro Chino\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"44.91768511862\"><body readability=\"91.478527607362\"><\/p>\n<p>A Chinese national was arrested Friday for his alleged role in administering and operating a residential proxy service that compromised millions of computers worldwide and was utilized in criminal operations that prosecutors linked to billions of dollars in losses. <\/p>\n<p>Prosecutors say YunHe Wang, 35, created the service known as \u201c911 S5\u201d in 2014 that aided cybercriminals in carrying out a wide range of activities \u2014 including ransomware, fraud, cyber attacks, child exploitation and bomb threats. Using various virtual private network services and pirated versions of other software, Wang installed malware on users\u2019 computers and then sold access to the compromised IP addresses of those devices to cybercriminals for a fee, generating roughly $99 million for himself between 2018 and July 2022. <\/p>\n<p>In 2022, 911 S5 was publicly exposed, prompting Wang to reconstitute the service as \u201cCloudRouter.\u201d <\/p>\n<p>Wang\u2019s proxy service compromised millions of Windows computers worldwide, according to the Department of Justice, resulting in 19 million unique IP addresses, including nearly 614,000 in the United States, being made available to Wang\u2019s clients. Using compromised IP addresses within the U.S., especially, is an important facilitator for cybercrime given that U.S. infrastructure is more trusted than some other countries\u2019, a senior FBI official told reporters Wednesday.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p><a href=\"https:\/\/cyberscoop.com\/radio\/fbi-deputy-assistant-director-for-cyber-operations-brett-leatherman\/\">Brett Leatherman<\/a>, the deputy assistant director for the FBI\u2019s Cyber Division, said that it is generally much easier to log into the online accounts of financial institutions in the United States using an American IP address, and by making American IP addresses available to cybercriminals, 911 S5 helped facilitate a wide range of criminal activity. \u201cAmerican citizens didn\u2019t know that their IP space was being utilized to attack U.S. businesses or defraud the U.S. government,\u201d Leatherman said.<\/p>\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" decoding=\"async\" width=\"640\" height=\"360\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime.png?resize=640%2C360&ssl=1\" alt class=\"wp-image-80585\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.png 1280w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.png?resize=300,168 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.png?resize=768,432 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.png?resize=1024,576 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.png?resize=600,337 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.png?resize=1200,675 1200w\" sizes=\"(max-width: 1280px) 100vw, 1280px\"><figcaption class=\"wp-element-caption\">Seizure notice posted to domains associated with 911 S5 and CloudRouter. (Courtesy FBI)<\/figcaption><\/figure>\n<p>The FBI has not determined whether any state-backed hackers used the 911 S5 service, but Leatherman said that as both a law enforcement and intelligence agency, the FBI is \u201calways concerned and looking to remove infrastructure from both criminal actors and nation states.\u201d <\/p>\n<p>Wang was arrested May 24 in Singapore, and U.S. authorities are working with their local counterparts to extradite him, Leatherman said. Wang faces charges of conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud and conspiracy to commit money laundering, according to the DOJ. He faces a maximum sentence of 65 years in prison.<\/p>\n<p>Wang, along with two associates \u2014 Jingping Liu and Yanni Zheng \u2014 were <a href=\"https:\/\/home.treasury.gov\/news\/press-releases\/jy2375\">sanctioned<\/a> by the U.S. Treasury Department on Tuesday for their roles in the operation. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>U.S. authorities seized 20 domains associated with the service\u2019s operation, according to <a href=\"https:\/\/www.justice.gov\/opa\/media\/1353521\/dl?inline\">a warrant filed<\/a> in the case. The Defense Criminal Investigative Service began probing 911 S5 in December 2020 when a suspected criminal residing in Ghana used the service to place fraudulent orders using stolen credit cards on the Army and Air Force Exchange Service\u2019s e-commerce platform, ShopMyExchange, according to the warrant.<\/p>\n<p>Investigators eventually determined that more than 47,000 fraudulent Economic Injury Disaster Loan applications originated from IP addresses compromised by 911 S5, exceeding $2.3 billion in loan payments, according to the warrant.<\/p>\n<p>Authorities also seized roughly $4 million worth of luxury watches, and roughly $30 million in real estate in Singapore, Thailand, Dubai and elsewhere, Leatherman said. Authorities also seized a number of high-priced cars, including one Ferrari, the DOJ said in a <a href=\"https:\/\/www.justice.gov\/opa\/pr\/911-s5-botnet-dismantled-and-its-administrator-arrested-coordinated-international-operation\">statement<\/a>, along with more than two dozen cryptocurrency wallets. <\/p>\n<p>The FBI also <a href=\"https:\/\/www.fbi.gov\/investigate\/cyber\/how-to-identify-and-remove-vpn-applications-that-contain-911-s5-backdoors\">created a page<\/a> where users can determine whether their computers had been infected.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.05\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/yunhe-wang-911s5-proxy-arrested\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Chinese national arrested for operating proxy service linked to billions<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2132,2133,282,669,2134,2135],"tags":[2136,2137,286,671,2138,2139],"class_list":["post-3795","post","type-post","status-publish","format-standard","hentry","category-911-s5","category-cloudrouter","category-cybercrime","category-federal-bureau-of-investigation-fbi","category-proxy-services","category-yunhe-wang","tag-911-s5","tag-cloudrouter","tag-cybercrime","tag-federal-bureau-of-investigation-fbi","tag-proxy-services","tag-yunhe-wang"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/911-s5\/\" rel=\"category tag\">911 S5<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cloudrouter\/\" rel=\"category tag\">CloudRouter<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/proxy-services\/\" rel=\"category tag\">proxy services<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/yunhe-wang\/\" rel=\"category tag\">YunHe Wang<\/a>","tag_info":"YunHe Wang","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=3795"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3795\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=3795"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=3795"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=3795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":3795,"date":"2024-05-29T14:15:22","date_gmt":"2024-05-29T19:15:22","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=80584"},"modified":"2024-05-29T14:15:22","modified_gmt":"2024-05-29T19:15:22","slug":"chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/05\/29\/chinese-national-arrested-for-operating-proxy-service-linked-to-billions-in-cybercrime\/","title":{"rendered":"Chinese national arrested for operating proxy service linked to billions in cybercrime\u00a0"},"content":{"rendered":"