Caproasia.com | The leading source of data, research, information & resource for financial professionals, investment managers, professional investors, family offices & advisors to institutions, billionaires, UHNWs & HNWs. Covering capital markets, investments and private wealth in Asia. How do you invest $3 million to $300 million? How do you manage $20 million to $3 billion of assets? Caproasia - Learn more
This site is for accredited investors, professional investors, investment managers and financial professionals only.
You should have assets around $3 million to $300 million or managing $20 million to $30 billion.
United States Arrested China and St. Kitts & Nevis Citizen YunHe Wang for Cybercrimes Using His Network Proxy Service Known as 911 S5 from 2014 to 2022, Received $99 Million & Bought 21 Properties in Singapore, Thailand, China, UAE, United States and St. Kitts & Nevis, Owns More than 12 Bank Accounts & Cars Including Rolls Royce, Ferrari F8 Spider S-A, BMW i8 & BMW X7 M50d, Proxy Service Allowed Creation of Botnet & Malware to Affect 19 Million Unique IP Addresses to Enable Cyber-Attacks, Large-Scale Fraud, Child Exploitation, Harassment, Bomb Threats & Export Violations
31st May 2024 | Hong Kong
United States has arrested China and St. Kitts & Nevis Citizen YunHe Wang for cybercrimes using his network proxy service known as 911 S5 from 2014 to 2022, and receiving $99 million which were used to buy 21 properties in Singapore, Thailand, China, UAE, United States and St. Kitts & Nevis, owns more than 12 bank accounts, and cars including Rolls Royce, Ferrari F8 Spider S-A, BMW i8 & BMW X7 M50d. The proxy service allowed the creation of botnet & malware to affect 19 million unique IP addresses to enable cyber-attacks, large-scale fraud, child exploitation, harassment, bomb threats & export violations. United States Department of Justice (29/5/24): “A court-authorized international law enforcement operation led by the U.S. Justice Department disrupted a botnet used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations. As part of this operation, YunHe Wang, 35, a People’s Republic of China national and St. Kitts and Nevis citizen-by-investment, was arrested on May 24 on criminal charges arising from his deployment of malware and the creation and operation of a residential proxy service known as “911 S5.” According to an indictment unsealed on May 24, from 2014 through July 2022, Wang and others are alleged to have created and disseminated malware to compromise and amass a network of millions of residential Windows computers worldwide. These devices were associated with more than 19 million unique IP addresses, including 613,841 IP addresses located in the United States. Wang then generated millions of dollars by offering cybercriminals access to these infected IP addresses for a fee … … The indictment further alleges that from 2018 until July 2022, Wang received approximately $99 million from his sales of the hijacked proxied IP addresses through his 911 S5 operation, either in cryptocurrency or fiat currency. Wang used the illicitly gained proceeds to purchase real property in the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates. The indictment identifies dozens of assets and properties subject to forfeiture, including a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, several luxury wristwatches, 21 residential or investment properties (across Thailand, Singapore, the U.A.E., St. Kitts and Nevis, and the United States), and 20 domains.” More info below:
“ United States Arrested China and St. Kitts & Nevis Citizen YunHe Wang for Cybercrimes Using His Network Proxy Service Known as 911 S5 from 2014 to 2022, Received $99 Million & Bought 21 Properties in Singapore, Thailand, China, UAE, United States and St. Kitts & Nevis, Owns More than 12 Bank Accounts & Cars Including Rolls Royce, Ferrari F8 Spider S-A, BMW i8 & BMW X7 M50d, Proxy Service Allowed Creation of Botnet & Malware to Affect 19 Million Unique IP Addresses to Enable Cyber-Attacks, Large-Scale Fraud, Child Exploitation, Harassment, Bomb Threats & Export Violations “
- Article continues below -
Quick Links, Ads & Announcements
Caproasia Access | Events | Summits | Register Events | The Financial Centre
The 2025 Investment Day | 2025 Family Office Summits | Family Office Circle
Sign Up
Basic Member: $5 Monthly | $60 Yearly
Newsletter Daily 2 pm (Promo): $20 Monthly | $180 Yearly (FP: $680)
The 2025 Investment Day
Hong Kong | Singapore
March / July / Sept / Oct / Nov
Private Equity, Hedge Funds, Boutique Funds, Private Markets & more. Join 20+ CIOs & Senior investment team, with > 60% single family offices with $300 million AUM. Taking place in Hong Kong and in Singapore. Every March, July, Sept, Oct & Nov.
Visit | Register here
The 2025 Family Office Summit10th April & 16th Oct Hong Kong St Regis | 17th April & 6th Nov Singapore Amara Sanctuary Resort
Join 80 single family offices & family office professionals in Hong Kong & Singapore
Links: 2025 Family Office Summit | Register here
2025 Investment / Alternatives Summit
March / Oct / Nov in Hong Kong & Singapore
Join leading asset managers, hedge funds, boutique funds, private equity, venture capital & real estate firms in Hong Kong, Singapore & Asia-Pacific at the Investment / Alternatives Summit. Join as delegate, speaker, presenter, partner & sponsor.
Visit | Register here
2025 Private Wealth Summit
April / Oct / Nov in Hong Kong & Singapore
Join CEOs, CIOs, Head of Private Banking, Head of Family Offices & Product Heads at The Private Wealth Summit. Join as delegate, speaker, presenter, partner & sponsor.
Visit | Register here
United States Arrested China and St. Kitts & Nevis Citizen YunHe Wang for Cybercrimes Using His Network Proxy Service Known as 911 S5 from 2014 to 2022, Received $99 Million & Bought 21 Properties in Singapore, Thailand, China, UAE, United States and St. Kitts & Nevis, Owns More than 12 Bank Accounts & Cars Including Rolls Royce, Ferrari F8 Spider S-A, BMW i8 & BMW X7 M50d, Proxy Service Allowed Creation of Botnet & Malware to Affect 19 Million Unique IP Addresses to Enable Cyber-Attacks, Large-Scale Fraud, Child Exploitation, Harassment, Bomb Threats & Export Violations
29th May 2024 – A court-authorized international law enforcement operation led by the U.S. Justice Department disrupted a botnet used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations. As part of this operation, YunHe Wang, 35, a People’s Republic of China national and St. Kitts and Nevis citizen-by-investment, was arrested on May 24 on criminal charges arising from his deployment of malware and the creation and operation of a residential proxy service known as “911 S5.” According to an indictment unsealed on May 24, from 2014 through July 2022, Wang and others are alleged to have created and disseminated malware to compromise and amass a network of millions of residential Windows computers worldwide. These devices were associated with more than 19 million unique IP addresses, including 613,841 IP addresses located in the United States. Wang then generated millions of dollars by offering cybercriminals access to these infected IP addresses for a fee.
- “This Justice Department-led operation brought together law enforcement partners from around the globe to disrupt 911 S5, a botnet that facilitated cyber-attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations,” said Attorney General Merrick B. Garland. “As a result of this operation, YunHe Wang was arrested on charges that he created and operated the botnet and deployed malware. This case makes clear that the long arm of the law stretches across borders and into the deepest shadows of the dark web, and the Justice Department will never stop fighting to hold cybercriminals to account.”
- “Working with our international partners, the FBI conducted a joint, sequenced cyber operation to dismantle the 911 S5 Botnet—likely the world’s largest botnet ever,” said FBI Director Christopher Wray. “We arrested its administrator, Yunhe Wang, seized infrastructure and assets, and levied sanctions against Wang and his co-conspirators. The 911 S5 Botnet infected computers in nearly 200 countries and facilitated a whole host of computer-enabled crimes, including financial frauds, identity theft, and child exploitation. This operation demonstrates the FBI’s commitment to working shoulder-to-shoulder with our partners to protect American businesses and the American people, and we will work tirelessly to unmask and arrest the cybercriminals who profit from this illegal activity.”
- According to court documents, Wang allegedly propagated his malware through Virtual Private Network (VPN) programs, such as MaskVPN and DewVPN (torrent distribution models that he operated) and pay-per-install services that bundled his malware with other program files, including pirated versions of licensed software or copyrighted materials. Wang then managed and controlled approximately 150 dedicated servers worldwide, approximately 76 of which he leased from U.S. based online service providers. Using the dedicated servers, Wang deployed and managed applications, commanded and controlled the infected devices, operated his 911 S5 service, and provided paying customers with access to proxied IP addresses associated with the infected devices.
- “As alleged in the indictment, Wang created malware that compromised millions of residential computers around the world and then sold access to the infected computers to cybercriminals,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyberstalking. Cybercriminals should take note. Today’s announcement sends a clear message that the Criminal Division and its law enforcement partners are firm in their resolve to disrupt the most technologically sophisticated criminal tools and hold wrongdoers to account.”
- “YunHe Wang created and administered a residential proxy service—a botnet known as 911 S5—that affected millions of computers all over the world,” said U.S. Attorney Damien M. Diggs for the Eastern District of Texas. “He will now be held accountable. Proxy services like 911 S5 are pervasive threats that shield criminals behind the compromised IP addresses of residential computers worldwide. Successfully tackling a problem of this scale is only possible with strong collaboration and exceptional investigative work between our law enforcement partners at home and abroad, and we stand ready to hold accountable anyone—no matter where they are located—who exploits our telecommunications infrastructure for their own criminal purpose.”
- Cybercriminals then used proxied IP addresses purchased from 911 S5 to conceal their true originating IP addresses and locations, and anonymously commit a wide array of offenses. These offenses including financial crimes, stalking, transmitting bomb threats and threats of harm, illegal exportation of goods, and receiving and sending child exploitation materials. Since 2014, 911 S5 allegedly enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.
- 911 S5 customers allegedly targeted certain pandemic relief programs. For example, the United States estimates that 560,000 fraudulent unemployment insurance claims originated from compromised IP addresses, resulting in a confirmed fraudulent loss exceeding $5.9 billion. Additionally, in evaluating suspected fraud loss to the Economic Injury Disaster Loan (EIDL) program, the United States estimates that more than 47,000 EIDL applications originated from IP addresses compromised by 911 S5. Millions of dollars more were similarly identified by financial institutions in the United States as loss originating from IP addresses compromised by 911 S5.
- The 911 S5 client interface software, which was hosted on U.S.-based servers, enabled cybercriminals located outside of the United States to purchase goods with stolen credit cards or criminally derived proceeds, and illegally export them outside of the United States contrary to U.S. export laws, such as the Export Administration Regulations (EAR). The 911 S5 client interface may also contain encryption or other features which subject it to export controls detailed in the EAR. Accordingly, downloads of the 911 S5 client interface software by certain foreign nationals without a license may constitute violations of the EAR.
- “The disruption, seizure, and arrest of the perpetrator(s) responsible for the 911 S5 cybercriminal enterprise demonstrates the forward leaning posture of the Department of Defense Office of Inspector General Defense Criminal Investigative Service (DCIS) Cyber Field Office,” said DCIS Director Kelly P. Mayo. “This investigation showcases the critical import of identifying and pursuing emerging threats and technologies targeting our warfighters, and the industrial base that supports them. Today’s announcement illustrates the magnitude of cooperation within federal law enforcement and our foreign partners pursuing criminals in the rapidly evolving cybercrime arena.”
- The indictment further alleges that from 2018 until July 2022, Wang received approximately $99 million from his sales of the hijacked proxied IP addresses through his 911 S5 operation, either in cryptocurrency or fiat currency. Wang used the illicitly gained proceeds to purchase real property in the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates. The indictment identifies dozens of assets and properties subject to forfeiture, including a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, several luxury wristwatches, 21 residential or investment properties (across Thailand, Singapore, the U.A.E., St. Kitts and Nevis, and the United States), and 20 domains.
- Law enforcement initially focused on 911 S5 during an investigation of a money laundering and smuggling scheme, where criminal actors in Ghana and the United States used hijacked IP addresses purchased from 911 S5 to place fraudulent orders using stolen credit cards on the Army and Air Force Exchange Service (AAFES) online e-commerce platform known as ShopMyExchange. Although approximately 2,525 fraudulent orders valued at $5.5 million were submitted, credit card fraud detection systems and federal investigators were able to thwart the bulk of the attempted purchases, reducing the actual loss to approximately $254,000.
- “The conduct alleged here reads like it’s ripped from a screenplay: A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials—then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate,” said Assistant Secretary for Export Enforcement Matthew S. Axelrod of the U.S. Department of Commerce’s Bureau of Industry and Security (BIS). “What they don’t show in the movies though is the painstaking work it takes by domestic and international law enforcement, working closely with industry partners, to take down such a brazen scheme and make an arrest like this happen.”
- Wang is charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. If convicted on all counts, Wang faces a maximum penalty of 65 years in prison.
- This operation was a coordinated multiagency effort led by law enforcement in the United States, Singapore, Thailand, and Germany. Agents and officers searched residences, seized assets valued at approximately $30 million, and identified additional forfeitable property valued at approximately $30 million. The operation also seized 23 domains and over 70 servers constituting the backbone of Wang’s prior residential proxy service and the recent incarnation of the service. By seizing multiple domains tied to the historical 911 S5, as well as several new domains and services directly linked to an effort to reconstitute the service, the government has successfully terminated Wang’s efforts to further victimize individuals through his newly formed service Clourouter.io and closed the existing malicious backdoors.
- On May 28, the Treasury Department’s Office of Foreign Assets Control (OFAC) issued financial sanctions against Wang, Jingping Liu, and Yanni Zheng, for their activities associated with 911 S5, and three entities for being owned or controlled by Wang.
- The FBI Dallas and Denver Field Offices, DCIS Cyber Field Office, and BIS Office of Export Enforcement’s Dallas field office are investigating the case.
- Trial Attorneys Candy Heath and Lydia Lichlyter of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorneys Camelia Lopez and William Tatum for the Eastern District of Texas are prosecuting the case.
- The Department appreciates the significant assistance provided by the Attorney-General’s Chambers of Singapore, Singapore Police Force (SPF), Royal Thai Police, and the Office of the Attorney General and the Anti-Money Laundering Office of the Kingdom of Thailand. The Justice Department’s Office of International Affairs and Money Laundering and Asset Recovery Section provided crucial support to this operation. The Treasury Department’s OFAC also provided support to this operation. Additionally, the Department offers its thanks to Chainalysis, the Shadowserver Foundation, and Microsoft for the assistance provided by each during the investigation and the operation.
- For more information or to determine if you are a victim of 911 S5 malware, please visit www.fbi.gov/911S5.
- An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.
Managing $20 million to $3 billion. Investing $3 million to $300 million.
For Investment Managers, Hedge Funds, Boutique Funds, Private Equity, Venture Capital, Professional Investors, Family Offices, Private Bankers & Advisors, sign up today. Subscribe to Caproasia and receive the latest news, data, insights & reports, events & programs daily at 2 pm.
Join Events & Find Services
Join Investments, Private Wealth, Family Office events in Hong Kong, Singapore, Asia-wide. Find hard-to-find $3 million to $300 million financial & investment services at The Financial Centre | TFC. Find financial, investment, private wealth, family office, real estate, luxury investments, citizenship, law firms & more. List hard-to-find financial & private wealth services.
Have a product launch? Promote a product or service? List your service at The Financial Centre | TFC. Join interviews & editorial and be featured on Caproasia.com or join Investments, Private Wealth, Family Office events. Contact us at [email protected] or [email protected]
Caproasia.com | The leading source of data, research, information & resource for financial professionals, investment managers, professional investors, family offices & advisors to institutions, billionaires, UHNWs & HNWs. Covering capital markets, investments and private wealth in Asia. How do you invest $3 million to $300 million? How do you manage $20 million to $3 billion of assets?
Quick Links
Caproasia Access | Events | Summits | Register Events | The Financial Centre
The 2025 Investment Day | 2025 Family Office Summits | Family Office Circle
2021 Data Release
2020 List of Private Banks in Hong Kong2020 List of Private Banks in Singapore
2020 Top 10 Largest Family Office2020 Top 10 Largest Multi-Family Offices2020 Report: Hong Kong Private Banks & Asset Mgmt - $4.49 Trillion2020 Report: Singapore Asset Mgmt - $3.48 Trillion AUM
For Investors | Professionals | Executives
Latest data, reports, insights, news, events & programs
Everyday at 2 pm
Direct to your inbox
Save 2 to 8 hours per week. Organised for success
Register Below
For CEOs, Heads, Senior Management, Market Heads, Desk Heads, Financial Professionals, Investment Managers, Asset Managers, Fund Managers, Hedge Funds, Boutique Funds, Analysts, Advisors, Wealth Managers, Private Bankers, Family Offices, Investment Bankers, Private Equity, Institutional Investors, Professional Investors
Get Ahead in 60 Seconds. Join 10,000 +
Save 2 to 8 hours weekly. Organised for Success.
Sign Up / Register
Web links may be disabled on mobile for security. Please click on desktop.
Caproasia Users
- Manage $20 million to $3 billion of assets
- Invest $3 million to $300 million
- Advise institutions, billionaires, UHNWs & HNWs
Caproasia Platforms | 11,000 Investors & Advisors
- Caproasia.com
- Caproasia Access
- Caproasia Events
- The Financial Centre | Find Services
- Membership
- Family Office Circle
- Professional Investor Circle
- Investor Relations Network
Monthly Roundtable & Networking
Family Office Programs
The 2025 Investment Day
- March - Hong Kong
- March - Singapore
- July - Hong Kong
- July - Singapore
- Sept- Hong Kong
- Sept - Singapore
- Oct- Hong Kong
- Nov - Singapore
- Visit: The Investment Day | Register: Click here
Caproasia Summits
- The Institutional Investor Summit
- The Investment / Alternatives Summit
- The Private Wealth Summit
- The Family Office Summit
- The CEO & Entrepreneur Summit
- The Capital Markets Summit
- The ESG / Sustainable Investment Summit
Contact Us
For Enquiries, Membership [email protected], [email protected] For Listing, Subscription [email protected], [email protected] For Press Release, send to: [email protected] For Events & Webinars [email protected] For Media Kit, Advertising, Sponsorships, Partnerships [email protected] For Research, Data, Surveys, Reports [email protected] For General Enquiries [email protected]Caproasia | Driving the future of Asia
a financial information technology co.
since 2014
