How the FBI took down the world's largest zombie 'botnet' (2024)

The United States is taking a major victory lap after federal authorities took down what was allegedly the largest zombie "botnet" in the world. A Chinese national, YunHe Wang, was arrested as the mastermind of 911 S5, a proxy bot service that was "used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats and export violations," the U.S. Department of Justice (DOJ) said in a press release.

The DOJ, FBI and other federal agencies, working in tandem with law enforcement from around the globe, were able to disrupt and shut down 911 S5, the press release said. Wang was arrested in Singapore "on charges that he created and operated the botnet and deployed malware." In addition, as part of the shutdown dubbed Operation Tunnel Rat, the feds "seized over $29 million in cryptocurrency, and Wang and associates were sanctioned by the U.S. Department of the Treasury," FBI Deputy Assistant Director for Cyber Operations Brett Leatherman said on LinkedIn.

The botnet is hardly the only criminal cyber operation, but was thought to be the most widespread; 911 S5 was believed to have infected more than 19 million IP addresses around the world, the DOJ said, including more than 613,000 in the U.S.

How did 911 S5 work?

The so-called "zombie" botnet was a system that deployed malware onto various computers, and was designed to infect as many devices as possible. The process began when Wang would allegedly sell his unsuspecting victims various VPN programs. These are computer extensions that are "used to encrypt an internet connection, routing it through a remote server to mask an IP address and hide the user's browsing history and location," said CBS News.

Once the victim downloaded the malicious VPN, it would supposedly give Wang access to the computer's aforementioned IP address. These are a "string of numbers and dots [that] act as unique identifiers for the devices and domains on the internet, allowing them to communicate with each other and send information back and forth," CBS said.

Wang is then alleged to have "doled out the stolen IP addresses to cybercriminals for millions of dollars to facilitate the illicit activity," said CBS. Criminals, operating under the guise of the victims' IP addresses, could then "carry out their schemes and avoid detection by law enforcement." These criminals used Wang's false IP addresses to steal "billions of dollars from financial institutions, credit card issuers and accountholders, and federal lending programs since 2014," according to a federal indictment seen by The Associated Press.

Altogether, Wang reportedly "made more than $99 million selling cybercriminals access to his hijacked devices," Attorney General Merrick Garland said in a statement, as his operation extended to nearly 200 countries. He would then use the funds to purchase luxury vehicles, real estate, watches and other high-end goods. Meanwhile, Wang's victims are "responsible for more than $5.9 billion in losses due to fraud against pandemic relief programs."

How can you protect yourself against other botnets?

The FBI has provided a framework for potential victims of 911 S5 to see if their IP address has been compromised. Moving forward, though, some sites have presented ways in which users can best protect themselves online.

It is important to keep all computer systems up-to-date, because botnets "are designed to exploit vulnerabilities in your network, which includes unpatched security risks in connected devices," said software company Ping Identity. This can be mitigated by making sure devices have updated security patches and antivirus software installed.

Another way to hinder botnets is through the use of multi-factor authentication (MFA). This "allows password-only logins to be replaced by faster and more secure login experiences," Ping Identity said. This can include a "biometric authentication method (such as a fingerprint or face identification) to authenticate" entry, making it harder for botnets to find a way in.

And if a botnet is installed on a device, it is important to detect it as quickly as possible," said cybersecurity firm SentinelOne, because "once a botnet gains entry and starts wreaking havoc, it's much more difficult to deal with." This means being on the lookout for abnormally high web server CPU load, excessive memory usage and non-native traffic profiles. All of these factors combined can help prevent the rise of further botnets.