US government sanctions massive proxy botnet operation offering free VPN services

The United States Department of the Treasury has sanctioned three Chinese nationals and three of their companies for running a large proxy botnet operation that infected consumer devices with malware and facilitated cybercrime on a global scale.

According to the Office of Foreign Assets Control (OFAC), the three individuals are Yunhe Wang, Jingping Liu and Yanni Zheng, while the companies are called Spicy Code Company Limited, Tulip Biz Pattaya Group Company Limited and Lily Suites Company Limited, all owned by Yunhe Wang and registered in Thailand.

The three created and operated 911 S5, a massive botnet controlling a residential proxy service known as “911 S5.”

Painful sanctions

A residential proxy botnet is a network of compromised devices, typically PCs, smartphones and others, located in residential areas. They are typically hijacked by malware and controlled to provide other cybercriminals with ways to route Internet traffic and thus remain anonymous while carrying out illegal activities online.

“These individuals leveraged their malicious botnet technology to compromise personal devices, allowing cybercriminals to fraudulently obtain economic assistance intended for those in need and terrorize our citizens with bomb threats,” said the Undersecretary Brian E. Nelson. “Treasury, in close coordination with our law enforcement colleagues and international partners, will continue to take action to disrupt cybercriminals and other illicit actors who seek to steal from American taxpayers.”

These sanctions mean that U.S. companies, banks, and other entities are not allowed to do business with these individuals or companies. Additionally, U.S. companies are not allowed to do business with other companies that provide services to these people, so the result can be very distressing for the recipients.

Apparently, the three were offering people a free VPN service, accompanied by malware that added their devices to the botnet. The botnet was later used by cybercriminals for a variety of purposes, including bomb threats launched across the United States two years ago, BeepComputer reported.