A 35-year-old Chinese national, Wang Yunhe, has been arrested in Singapore for his involvement in creating and operating malware that facilitated the establishment of a vast network of zombie computers. This network reportedly enabled cyber criminals to steal billions of dollars through various illegal activities.

Wang’s arrest occurred on May 24, 2024, as part of a coordinated multi-jurisdictional operation led by the United States Department of Justice (DOJ), in collaboration with local law enforcement agencies, including the Singapore Police Force (SPF).

According to the DOJ, Wang allegedly collaborated with others from 2014 to July 2022 to develop and distribute the 911 S5 Botnet, which infected millions of home-based Windows computers worldwide. A botnet refers to a collection of internet-connected devices that are infected and controlled by hackers without the owners’ knowledge.

Principal Deputy Assistant Attorney General Nicole Argentieri highlighted that the malware Wang created compromised residential computers globally, selling access to these infected machines to cyber criminals. These criminals utilized the hijacked computers to obscure their identities while committing crimes, ranging from financial fraud to cyberstalking.

The DOJ’s statement revealed that over 19 million internet protocol (IP) addresses became part of what is now considered the “world’s largest botnet.” Wang’s botnet has been linked to numerous cyber-enabled crimes, including identity theft and child exploitation, affecting nearly 200 countries.

Wang, who also possesses citizenship from St Kitts and Nevis, allegedly generated S$134 million from cyber criminals using his network between 2018 and July 2022. Reports indicate that he invested these proceeds in 21 properties across several countries, including the US, Singapore, Thailand, China, and the United Arab Emirates.

In addition to his properties, Wang owned various companies, including Eternal Code, which was incorporated in Singapore in 2020 and dealt in computer software sales. Court documents described his registered firms as “shell companies,” utilized to obscure the identity and illegitimate nature of his cyber operations.

As a result of his alleged activities, Wang faces potential seizure of numerous assets, including a 2022 Ferrari F8 Spider registered in Singapore, various bank accounts, and luxury watches.

The DOJ further stated that Wang’s network targeted Covid-19 relief programs in the US, leading to fraudulent claims exceeding US$5.9 billion. The multi-agency investigation resulted in the seizure of 23 domains and over 70 servers worldwide, which were integral to Wang’s operations.

The US Treasury Department has placed Wang on its sanctions list alongside two other Chinese nationals connected to his activities. If convicted on all charges, Wang faces a maximum sentence of 65 years in a US prison.