How the FBI took down the world's largest zombie 'botnet'
The bot allegedly infected more than 19 million IP addresses across the world


The United States is taking a major victory lap after federal authorities took down what was allegedly the largest zombie "botnet" in the world. A Chinese national, YunHe Wang, was arrested as the mastermind of 911 S5, a proxy bot service that was "used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats and export violations," the U.S. Department of Justice (DOJ) said in a press release.
The DOJ, FBI and other federal agencies, working in tandem with law enforcement from around the globe, were able to disrupt and shut down 911 S5, the press release said. Wang was arrested in Singapore "on charges that he created and operated the botnet and deployed malware." In addition, as part of the shutdown dubbed Operation Tunnel Rat, the feds "seized over $29 million in cryptocurrency, and Wang and associates were sanctioned by the U.S. Department of the Treasury," FBI Deputy Assistant Director for Cyber Operations Brett Leatherman said on LinkedIn.
The botnet is hardly the only criminal cyber operation, but was thought to be the most widespread; 911 S5 was believed to have infected more than 19 million IP addresses around the world, the DOJ said, including more than 613,000 in the U.S.
Subscribe to The Week
Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

Sign up for The Week's Free Newsletters
From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.
From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.
How did 911 S5 work?
The so-called "zombie" botnet was a system that deployed malware onto various computers, and was designed to infect as many devices as possible. The process began when Wang would allegedly sell his unsuspecting victims various VPN programs. These are computer extensions that are "used to encrypt an internet connection, routing it through a remote server to mask an IP address and hide the user's browsing history and location," said CBS News.
Once the victim downloaded the malicious VPN, it would supposedly give Wang access to the computer's aforementioned IP address. These are a "string of numbers and dots [that] act as unique identifiers for the devices and domains on the internet, allowing them to communicate with each other and send information back and forth," CBS said.
Wang is then alleged to have "doled out the stolen IP addresses to cybercriminals for millions of dollars to facilitate the illicit activity," said CBS. Criminals, operating under the guise of the victims' IP addresses, could then "carry out their schemes and avoid detection by law enforcement." These criminals used Wang's false IP addresses to steal "billions of dollars from financial institutions, credit card issuers and accountholders, and federal lending programs since 2014," according to a federal indictment seen by The Associated Press.
Altogether, Wang reportedly "made more than $99 million selling cybercriminals access to his hijacked devices," Attorney General Merrick Garland said in a statement, as his operation extended to nearly 200 countries. He would then use the funds to purchase luxury vehicles, real estate, watches and other high-end goods. Meanwhile, Wang's victims are "responsible for more than $5.9 billion in losses due to fraud against pandemic relief programs."
How can you protect yourself against other botnets?
The FBI has provided a framework for potential victims of 911 S5 to see if their IP address has been compromised. Moving forward, though, some sites have presented ways in which users can best protect themselves online.
It is important to keep all computer systems up-to-date, because botnets "are designed to exploit vulnerabilities in your network, which includes unpatched security risks in connected devices," said software company Ping Identity. This can be mitigated by making sure devices have updated security patches and antivirus software installed.
Another way to hinder botnets is through the use of multi-factor authentication (MFA). This "allows password-only logins to be replaced by faster and more secure login experiences," Ping Identity said. This can include a "biometric authentication method (such as a fingerprint or face identification) to authenticate" entry, making it harder for botnets to find a way in.
And if a botnet is installed on a device, it is important to detect it as quickly as possible," said cybersecurity firm SentinelOne, because "once a botnet gains entry and starts wreaking havoc, it's much more difficult to deal with." This means being on the lookout for abnormally high web server CPU load, excessive memory usage and non-native traffic profiles. All of these factors combined can help prevent the rise of further botnets.
Sign up for Today's Best Articles in your inbox
A free daily email with the biggest news stories of the day – and the best features from TheWeek.com
Justin Klawans has worked as a staff writer at The Week since 2022. He began his career covering local news before joining Newsweek as a breaking news reporter, where he wrote about politics, national and global affairs, business, crime, sports, film, television and other news. Justin has also freelanced for outlets including Collider and United Press International.
-
What It Feels Like for a Girl: a 'fearless and compelling' coming-of-age drama
The Week Recommends Ellis Howard dazzles in this 'sharply written' adaptation of Paris Lees' memoir
-
Sports betting is causing athletes to be abused and harassed online
Under the radar Baseball players, tennis stars and others have raised the alarm
-
Crossword: June 4, 2025
The Week's daily crossword
-
When did computer passwords become a thing?
The Explainer People have been racking their brains for good codes for longer than you might think
-
Airplane crash-detection systems could be vulnerable to hackers
Under the Radar 'The idea scares the shit out of me,' one pilot said
-
How the AI takeover might affect women more than men
The Explainer The tech boom is a blow to gender equality
-
Did you get a call from a government official? It might be an AI scam.
The Explainer Hackers may be using AI to impersonate senior government officers, said the FBI
-
Digital consent: Law targets deepfake and revenge porn
Feature The Senate has passed a new bill that will make it a crime to share explicit AI-generated images of minors and adults without consent
-
Elon Musk's SpaceX has created a new city in Texas
Under The Radar Starbase is home to SpaceX's rocket launch site
-
Amazon launches 1st Kuiper internet satellites
Speed Read The battle of billionaires continues in space
-
Not invincible: Tech burned by tariff war
Feature Tariffs on Asian countries are shaking up Silicon Valley, driving up prices and deepening global tensions