How the FBI took down the world's largest zombie 'botnet'
The bot allegedly infected more than 19 million IP addresses across the world


The United States is taking a major victory lap after federal authorities took down what was allegedly the largest zombie "botnet" in the world. A Chinese national, YunHe Wang, was arrested as the mastermind of 911 S5, a proxy bot service that was "used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats and export violations," the U.S. Department of Justice (DOJ) said in a press release.
The DOJ, FBI and other federal agencies, working in tandem with law enforcement from around the globe, were able to disrupt and shut down 911 S5, the press release said. Wang was arrested in Singapore "on charges that he created and operated the botnet and deployed malware." In addition, as part of the shutdown dubbed Operation Tunnel Rat, the feds "seized over $29 million in cryptocurrency, and Wang and associates were sanctioned by the U.S. Department of the Treasury," FBI Deputy Assistant Director for Cyber Operations Brett Leatherman said on LinkedIn.
The botnet is hardly the only criminal cyber operation, but was thought to be the most widespread; 911 S5 was believed to have infected more than 19 million IP addresses around the world, the DOJ said, including more than 613,000 in the U.S.
Subscribe to The Week
Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

Sign up for The Week's Free Newsletters
From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.
From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.
How did 911 S5 work?
The so-called "zombie" botnet was a system that deployed malware onto various computers, and was designed to infect as many devices as possible. The process began when Wang would allegedly sell his unsuspecting victims various VPN programs. These are computer extensions that are "used to encrypt an internet connection, routing it through a remote server to mask an IP address and hide the user's browsing history and location," said CBS News.
Once the victim downloaded the malicious VPN, it would supposedly give Wang access to the computer's aforementioned IP address. These are a "string of numbers and dots [that] act as unique identifiers for the devices and domains on the internet, allowing them to communicate with each other and send information back and forth," CBS said.
Wang is then alleged to have "doled out the stolen IP addresses to cybercriminals for millions of dollars to facilitate the illicit activity," said CBS. Criminals, operating under the guise of the victims' IP addresses, could then "carry out their schemes and avoid detection by law enforcement." These criminals used Wang's false IP addresses to steal "billions of dollars from financial institutions, credit card issuers and accountholders, and federal lending programs since 2014," according to a federal indictment seen by The Associated Press.
Altogether, Wang reportedly "made more than $99 million selling cybercriminals access to his hijacked devices," Attorney General Merrick Garland said in a statement, as his operation extended to nearly 200 countries. He would then use the funds to purchase luxury vehicles, real estate, watches and other high-end goods. Meanwhile, Wang's victims are "responsible for more than $5.9 billion in losses due to fraud against pandemic relief programs."
How can you protect yourself against other botnets?
The FBI has provided a framework for potential victims of 911 S5 to see if their IP address has been compromised. Moving forward, though, some sites have presented ways in which users can best protect themselves online.
It is important to keep all computer systems up-to-date, because botnets "are designed to exploit vulnerabilities in your network, which includes unpatched security risks in connected devices," said software company Ping Identity. This can be mitigated by making sure devices have updated security patches and antivirus software installed.
Another way to hinder botnets is through the use of multi-factor authentication (MFA). This "allows password-only logins to be replaced by faster and more secure login experiences," Ping Identity said. This can include a "biometric authentication method (such as a fingerprint or face identification) to authenticate" entry, making it harder for botnets to find a way in.
And if a botnet is installed on a device, it is important to detect it as quickly as possible," said cybersecurity firm SentinelOne, because "once a botnet gains entry and starts wreaking havoc, it's much more difficult to deal with." This means being on the lookout for abnormally high web server CPU load, excessive memory usage and non-native traffic profiles. All of these factors combined can help prevent the rise of further botnets.
A free daily email with the biggest news stories of the day – and the best features from TheWeek.com
Justin Klawans has worked as a staff writer at The Week since 2022. He began his career covering local news before joining Newsweek as a breaking news reporter, where he wrote about politics, national and global affairs, business, crime, sports, film, television and other news. Justin has also freelanced for outlets including Collider and United Press International.
-
Morales seeks re-election defying constitution and criminal charges
Under the Radar Supporters of former president Evo Morales clash with authorities as political and economic turmoil deepens
-
June 22 editorial cartoons
Cartoons Sunday’s political cartoons include a SpaceX flight, Bibi pulling Donald Trump toward war, and an ICE agent looking like a bank robber
-
5 bunker-busting cartoons about the Israel-Iran war
Cartoons Political cartoonists take on Iran waiting for Pete Hegseth to leak war plans and Donald Trump's wish for a Nobel prize
-
Unreal: A quantum leap in AI video
Feature Google's new Veo 3 is making it harder to distinguish between real videos and AI-generated ones
-
College grads are seeking their first jobs. Is AI in the way?
In The Spotlight Unemployment is rising for young professionals
-
Learning loss: AI cheating upends education
Feature Teachers are questioning the future of education as students turn to AI for help with their assignments
-
Bitcoin braces for a quantum computing onslaught
IN THE SPOTLIGHT The cryptocurrency community is starting to worry over a new generation of super-powered computers that could turn the digital monetary world on its head.
-
When did computer passwords become a thing?
The Explainer People have been racking their brains for good codes for longer than you might think
-
Airplane crash-detection systems could be vulnerable to hackers
Under the Radar 'The idea scares the shit out of me,' one pilot said
-
How the AI takeover might affect women more than men
The Explainer The tech boom is a blow to gender equality
-
Did you get a call from a government official? It might be an AI scam.
The Explainer Hackers may be using AI to impersonate senior government officers, said the FBI