Singapore to extradite Chinese national to US over alleged worldwide botnet cybercrime

SINGAPORE: Chinese national Wang Yunhe, who was arrested by Singapore authorities on 24 May stands accused of operating the 911 S5 proxy botnet, facilitating cybercriminals in stealing billions. Reportedly, he will be extradited to the United States for trial.

Wang, 35, also a citizen of St Kitts and Nevis, faces charges related to deploying malware and managing a residential proxy service known as “911 S5.”

Wang’s arrest was part of a multi-jurisdictional operation spearheaded by the United States Department of Justice (DOJ).

The arrest follows a meticulous investigation by international law enforcement agencies, including the Singapore Police Force (SPF).

Singapore police informed Singapore Chinese media Lianhe Zaobao on Thursday (30 May) that they, along with the Attorney General’s Chambers (AGC), have been collaborating with the US Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) since August 2022.

According to Zaobao’s report, Wang Yunhe was arrested at his residence last Friday at the request of the United States

Singapore and the US have an extradition treaty in place.

The police disclosed that Wang Yunhe has held an employment pass since 2022.

Regarding any potential offences committed by Wang in Singapore, SPF stated that the US-led investigation is underway, and the police will fully cooperate with the US investigation.

As per a press statement released by the US Department of Justice on 29 May, Wang and his associates are accused of creating and disseminating malware from 2014 to July 2022.

This malware infected millions of residential Windows computers worldwide, amassing a network of over 19 million unique IP addresses, including more than 600,000 in the United States.

Wang allegedly profited by offering cybercriminals access to these infected IP addresses for a fee.

Wang’s holdings span 21 properties worldwide

According to the US Court documents, Wang’s modus operandi allegedly involved propagating malware through Virtual Private Network (VPN) programs, such as MaskVPN and DewVPN (torrent distribution models that he operated) and pay-per-install services, thereby compromising millions of computers globally.

He managed approximately 150 dedicated servers worldwide, with a significant portion leased from U.S.-based service providers, to operate his criminal enterprise.

The indictment further reveals that Wang amassed approximately US$99 million, either in cryptocurrency or fiat currency, in illicit proceeds from his 911 S5 operation.

He used these funds to fuel an extravagant lifestyle, purchasing 21 properties across various countries, including the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates.

Among Wang’s extravagant acquisitions were top-tier vehicles such as a Singapore-registered 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, and a condominium unit in Angullia Park.

Additionally, he maintained more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, and a collection of luxury wristwatches.

Further scrutiny of U.S. court documents reveals Wang’s ownership and operation of several companies across various jurisdictions.

Notably, Eternal Code in Singapore, which has since been dissolved, was registered at an office building on Robinson Road and specialized in the wholesale distribution of computer software.

On 15 January 2022, Wang was appointed as director of two active firms: Gold Click, a holding company, and Universe Capital Management, a consultancy firm.

Court documents characterized the firms registered by Wang as “shell companies he used to conceal the identity and illegitimate nature of his 911 S5 service and its related proceeds”.

Wang faces charges including conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering, carrying a maximum penalty of 65 years in prison if convicted on all counts.

According to the DOJ, Wang’s customers allegedly targeted Covid-19 relief programs in the US, leading to losses exceeding US$5.9 billion due to fraudulent claims made from compromised IP addresses.

Collaborative efforts among law enforcement agencies in the United States, Singapore, Thailand, and Germany resulted in the seizure of assets valued at approximately US$30 million, with additional forfeitable property identified at a similar value.

Law enforcement agencies also confiscated 23 domains and more than 70 servers located worldwide, which served as the backbone of Wang’s criminal activities.

Moreover, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) imposed financial sanctions against Wang and his associates, Jingping Liu and Yanni Zheng, for their involvement with 911 S5. The sanctions also targeted three entities owned or controlled by Wang.

Liu, identified as Wang’s co-conspirator in laundering proceeds from criminal activities, shares a common address with Wang at the condominium in Angullia Park in Singapore.

Meanwhile, Zheng, who had no residential information in Singapore according to the Treasury Department, was described as an individual involved in conducting business transactions and purchasing real estate property on Wang’s behalf.