Chinese national in alleged global botnet cybercrime refuses extradition to US

SINGAPORE: Wang Yunhe, a 35-year-old Chinese national, currently in remand after being arrested by Singapore authorities for his alleged involvement in the world’s largest botnet cybercrime, appeared in court via video-link on Thursday (6 June) before District Judge Tan Jen Tse.

During the proceedings, when questioned by Judge Tan regarding his consent to the US extradition request, Wang, communicating through a Mandarin interpreter, reiterated his refusal.

This marks the second time Wang has voiced his objection to extradition to the US, following his initial objection during a court mention on 31 May.

Wang was arrested at his residence on 24 May at the request of the United States. Singapore and the US have an extradition treaty in place.

In April 2022, amendments to the Extradition Act were introduced, allowing fugitives the option to consent to their extradition, aligning with international norms aimed at optimizing state resources and minimizing unnecessary detention in Singapore.

Even in cases where a fugitive does not consent to extradition, the court retains the authority to order it if specific conditions are satisfied.

During the Thursday court proceeding, State Counsel Anupriya A Daniel requested Wang’s remand for seven days, in accordance with the Extradition Act, which limits remand periods to a maximum of seven days at a time.

In response, Wang’s defence counsel Mr Ng Yuan Siang, sought a similar adjournment of the same duration to consult with his client.

Wang’s case is scheduled to be heard again on 12 June.

In an earlier report, the police disclosed that Wang Yunhe has held an employment pass since 2022.

Regarding any potential offences committed by Wang in Singapore, SPF stated that the US-led investigation is underway, and the police will fully cooperate with the US investigation.

As per a press statement released by the US Department of Justice on 29 May, Wang and his associates are accused of creating and disseminating malware from 2014 to July 2022.

This malware infected millions of residential Windows computers worldwide, amassing a network of over 19 million unique IP addresses, including more than 600,000 in the United States.

Wang allegedly profited by offering cybercriminals access to these infected IP addresses for a fee.

According to the US Court documents, Wang’s modus operandi allegedly involved propagating malware through Virtual Private Network (VPN) programs, such as MaskVPN and DewVPN (torrent distribution models that he operated) and pay-per-install services, thereby compromising millions of computers globally.

He managed approximately 150 dedicated servers worldwide, with a significant portion leased from U.S.-based service providers, to operate his criminal enterprise.

The indictment further reveals that Wang amassed approximately US$99 million, either in cryptocurrency or fiat currency, in illicit proceeds from his 911 S5 operation.

He used these funds to fuel an extravagant lifestyle, purchasing 21 properties across various countries, including the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates.

Among Wang’s extravagant acquisitions were top-tier vehicles such as a Singapore-registered 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, and a condominium unit in Angullia Park.

Additionally, he maintained more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, and a collection of luxury wristwatches.

Wang faces charges including conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering, carrying a maximum penalty of 65 years in prison if convicted on all counts.

According to the DOJ, Wang’s customers allegedly targeted Covid-19 relief programs in the US, leading to losses exceeding US$5.9 billion due to fraudulent claims made from compromised IP addresses.

Collaborative efforts among law enforcement agencies in the United States, Singapore, Thailand, and Germany resulted in the seizure of assets valued at approximately US$30 million, with additional forfeitable property identified at a similar value.

Law enforcement agencies also confiscated 23 domains and more than 70 servers located worldwide, which served as the backbone of Wang’s criminal activities.