Chinese national arrested in Singapore for operating multi-billion dollar cybercrime network

SINGAPORE: A 35-year-old Chinese national, Wang Yunhe, has been arrested in Singapore for his alleged involvement in creating and operating malware, which enabled cybercriminals to pilfer billions of dollars globally.

Wang’s arrest on 24 May was part of a multi-jurisdictional operation spearheaded by the United States Department of Justice (DOJ).

The arrest follows a meticulous investigation by international law enforcement agencies, including the Singapore Police Force (SPF).

Wang, who also holds citizenship in St Kitts and Nevis, faces charges stemming from his role in deploying malware and operating a residential proxy service known as “911 S5.”

As per a press statement released by the US Department of Justice on 29 May, Wang and his associates are accused of creating and disseminating malware from 2014 to July 2022.

This malware infected millions of residential Windows computers worldwide, amassing a network of over 19 million unique IP addresses, including more than 600,000 in the United States.

Wang allegedly profited by offering cybercriminals access to these infected IP addresses for a fee.

Attorney General Merrick B. Garland highlighted the collaborative effort among global law enforcement partners to disrupt 911 S5, a botnet that facilitated various cybercrimes ranging from fraud to child exploitation.

FBI Director Christopher Wray emphasized the significant impact of dismantling the 911 S5 Botnet, which infected computers in nearly 200 countries and enabled a myriad of computer-enabled offences.

Wang’s holdings spanning 21 properties worldwide

According to the US Court documents, Wang’s modus operandi allegedly involved propagating malware through Virtual Private Network (VPN) programs, such as MaskVPN and DewVPN (torrent distribution models that he operated) and pay-per-install services, thereby compromising millions of computers globally.

He managed approximately 150 dedicated servers worldwide, with a significant portion leased from U.S.-based service providers, to operate his criminal enterprise.

The indictment further reveals that Wang amassed approximately US$99 million, either in cryptocurrency or fiat currency, in illicit proceeds from his 911 S5 operation.

He used these funds to fuel an extravagant lifestyle, purchasing 21 properties across various countries, including the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates.

Among Wang’s extravagant acquisitions were top-tier vehicles such as a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, and a Rolls Royce.

Additionally, he maintained more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, and a collection of luxury wristwatches.

Further scrutiny of U.S. court documents reveals Wang’s ownership and operation of several companies across various jurisdictions.

Notably, Eternal Code in Singapore, which has since been dissolved, was registered at an office building on Robinson Road and specialized in the wholesale distribution of computer software.

Court documents characterized the firms registered by Wang as “shell companies he used to conceal the identity and illegitimate nature of his 911 S5 service and its related proceeds”.

DOJ indicated that dozens of his assets and properties could be subject to seizure.

The scope of the operation extended into various criminal activities, encompassing financial fraud, identity theft, and illegal exportation of goods, resulting in losses amounting to billions of dollars.

Wang faces charges including conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering, carrying a maximum penalty of 65 years in prison if convicted on all counts.

According to the DOJ, Wang’s customers allegedly targeted Covid-19 relief programs in the US, leading to losses exceeding US$5.9 billion due to fraudulent claims made from compromised IP addresses.

Collaborative efforts among law enforcement agencies in the United States, Singapore, Thailand, and Germany resulted in the seizure of assets valued at approximately US$30 million, with additional forfeitable property identified at a similar value.

Law enforcement agencies also confiscated 23 domains and more than 70 servers located worldwide, which served as the backbone of Wang’s criminal activities.

Moreover, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) imposed financial sanctions against Wang and his associates, Jingping Liu and Yanni Zheng, for their involvement with 911 S5. The sanctions also targeted three entities owned or controlled by Wang.

Liu, identified as Wang’s co-conspirator in laundering proceeds from criminal activities, shares a common address with Wang at the condominium in Angullia Park in Singapore.

Meanwhile, Zheng, who had no residential information in Singapore according to the Treasury Department, was described as an individual involved in conducting business transactions and purchasing real estate property on Wang’s behalf.

The three firms associated with Wang are all based in Chonburi, located south of the Thai capital Bangkok.