---
title: "Multibillion Dollar Botnet Scam Traced Back to a Single Person"
description: "The feds arrested Yunhe Wan, who they say perpetrated a massive botnet scheme that swindled billions and facilitated child exploitation."
date: "2024-06-02"
modified: "2024-06-02"
authors:
  - name: "Maggie Harrison Dupré"
    job_title: "Senior Staff Writer"
    link: "https://futurism.com/authors/mharrison"
url: "https://futurism.com/the-byte/multibillion-dollar-botnet-scam"
categories:
  - "Future Society"
tags:
  - "botnet"
  - "cybercrime"
  - "cybersecurity"
  - "the digest"
---

# Multibillion Dollar Botnet Scam Traced Back to a Single Person

![The feds arrested Yunhe Wan, who they say perpetrated a massive botnet scheme that swindled billions and facilitated child exploitation.](<https://futurism.com/wp-content/uploads/2024/05/multibillion-dollar-botnet-scam.jpg>)
*\<em\>Image: Getty / Futurism\</em\>*

## Zombie Army

In what stands to be a major cybersecurity win for US law enforcement, the Department of Justice announced the arrest of Yunhe Wan — a 35-year-old Chinese national accused of perpetrating what the FBI says is likely the biggest botnet scheme in history.

According [to a DOJ press release](<https://www.justice.gov/opa/pr/911-s5-botnet-dismantled-and-its-administrator-arrested-coordinated-international-operation>), officials allege that Wan and his co-conspirators used pop-ups advertising alleged VPN services to distribute malware that infected "millions" of residential Windows computers in nearly 200 countries, creating an extensive residential proxy service (basically, a secret communication highway that hides users behind the IP addresses of real people.)

Wan sold access to the network — known as "911 S5" — to other cybercriminals, who used it to commit "a whole host of computer-enabled crimes, including financial frauds, identity theft, and child exploitation," according to a statement by FBI director Christopher Wray.

The illicit scheme was massively successful. According to the DOJ, 911 S5 raked in an eye-watering $99 million since its inception in 2014. Wan spent much of that income on luxury properties, cars, watches, and more.

"The conduct alleged here reads like it's ripped from a screenplay," said Department of Commerce official Matthew Axelrod in a statement. "A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme's nearly $100 million in profits to buy luxury cars, watches, and real estate."

## Finders Keepers

Now in custody, Wan has been charged with "conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering," per the release. He faces up to 65 years in prison.

Wan must've enjoyed an extremely lavish lifestyle. According to the DOJ, his "2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, several luxury wristwatches, 21 residential or investment properties (across Thailand, Singapore, the \[United Arab Emirates\], St. Kitts and Nevis, and the United States), and 20 domains," are all up for forfeiture.

One of the more striking allegations in the [indictment](<https://www.justice.gov/opa/media/1353516/dl?inline>) against Wan is that 911 S5 allowed foreign actors to pose as unemployed US citizens during the coronavirus pandemic. Together, these actors drained nearly $6 billion in COVID aid funding from the US government.

911 S5 was also used for cyberstalking purposes and facilitated the passage of child sexual abuse materials.

Where the case goes next, and what a conviction would mean for [victims of 911 S5-related crimes](<https://www.fbi.gov/investigate/cyber/how-to-identify-and-remove-vpn-applications-that-contain-911-s5-backdoors>) in terms of retribution, remains to be seen.

**More on cybersecurity:** *[Researchers Create AI-Powered Malware That Spreads on Its Own](<https://futurism.com/researchers-create-ai-malware>)*

## Author
At Futurism, I've reported extensively on the rise of AI as a cultural and business force shaping the media industry, and more broadly how those dynamics are changing how we all consume and share information and relate to one another. I'm also fascinated by public health policy and ethics, the role of emerging tech in politics and governance — and the powerful people and forces at those intersections — climate change, and the environment. My investigation on Sports Illustrated's use of AI-generated authors with fictional biographies won a 2024 Mirror Award for "Best Story on Media Coverage of Artificial Intelligence in Journalism and the Media" from Syracuse University's SI Newhouse School, I contributed to Niemen Lab's 2025 Predictions for Journalism series, and I've discussed my work for Futurism during appearances on NPR, CNN, the BBC, the CBC, and more. I grew up in rural Pennsylvania and attended the University of Massachusetts Amherst, where I played Division I field hockey for the Minutewomen as a midfielder. Since then, I've lived in New Orleans, Louisiana and Manhattan, New York. I spend my free time running, reading, perusing archival fashion, and searching for the world’s best negroni. I also have a debonair tuxedo cat, Westley, who's named after "The Princess Bride."

### Author social links  
[Bluesky](<https://bsky.app/profile/mharrisondupre.bsky.social>)