On May 29, 2024, the U.S. Department of Justice announced the neutralization of botnet 911 S5. Law enforcement seized associated domains and arrested administrator YunHe Wang to halt the operation.
Analysis by 360 Netlab indicates the organization operated between 2014 and July 2022 before re-emerging as CloudRouter in October 2023. The infrastructure encompassed approximately 19 million IP addresses across multiple jurisdictions prior to the May 2024 intervention.
The group distributed free VPN applications bundled with malware to infect users. These programs created persistent services acting as backdoors to grant proxy access to 911 S5 clients for command and control.
Shared infrastructure connects related domains to specific server IPs, such as 173.244.211.96, validating 360 Netlab's analysis of shared ownership between VPN services and the botnet infrastructure.
Although law enforcement action neutralized the immediate infrastructure, the operational methods and compromised device ecosystem suggest continued risks for network security professionals.