Arrest of Wang Yunhe in Singapore, alleged to have run world’s largest botnet, a major blow to cybercrime: experts

“Bringing down a botnet is a big thing, it means cutting off access to other cybercriminals who would have used this network of zombie residential computers for nefarious purposes,” said David Siah, the executive vice-president for Southeast Asia-Australia at the Centre of Strategic Cyberspace & International Studies think tank.

The United States’ Department of Justice (DOJ) said in a statement on Wednesday that Wang had amassed at least US$99 million in profits by reselling access to criminals who used the botnet for identity theft, child exploitation and financial fraud.

The DOJ quoted FBI Director Christopher Wray as saying on Wednesday that the “911 S5” botnet – a network of malware-infected computers in nearly 200 countries – was likely the world’s largest.

06:18

‘It’s scary’: Asian cryptocurrency scams bilk tens of thousands of ‘brainwashed’ victims

The DOJ cited an indictment, unsealed on May 24, alleging Wang and associates created and disseminated the malware to compromise and amass a network of millions of residential Windows computers worldwide from 2014 through July 2022.

These devices were associated with more than 19 million unique IP addresses, and Wang generated millions of dollars by offering cybercriminals access to these infected IP addresses for a fee.

Anthony Lim, a cybersecurity governance and fintech fellow at the Singapore University of Social Sciences, called the discovery of the 19 million compromised IP addresses “huge”.

“It’s 19 million different pieces of equipment. This is surely a big arrest, but unfortunately I think it’s not unique because there have been and probably are other botnets in the world,” he said.

Lim explained that the kind of malware used to create these botnets goes into a computer