News
Chinese national charged with operating ‘world’s largest botnet’ linked to billions in cybercrimes
Colonial Pipeline hack only latest in rising ransomware threats
Hackers hit hundreds of critical systems last year and watchdogs say we’re not doing enough head off more.
STAFF VIDEO, USA TODAY
A Chinese national has been arrested for his role in operating a residential proxy service that was used to defraud billions of dollars from the U.S. government and fund his lavish lifestyle, which included buying luxury cars and property around the world, the Department of Justice announced Wednesday.
YunHe Wang, 35, was arrested on May 24 and charged with creating a massive network of hijacked computer devices, also known as a “botnet,” that was used to conduct cyber attacks, fraud, child exploitation, bomb threats, and export violations, the department alleged. Wang administered the botnet, called “911 S5,” through about 150 servers worldwide from 2014 to 2022, according to an indictment unsealed last week.
About 76 of the servers were leased from online service providers based in the United States, the indictment said. The botnet infected over 19 million IP addresses in nearly 200 countries, including over 613,000 IP addresses located in the United States, according to prosecutors.
The Justice Department announcement comes after Wang and his two co-conspirators, Jingping Liu and Yanni Zheng, were sanctioned by the Department of Treasury for their alleged involvement with the malicious botnet. The department also imposed sanctions on three luxury companies Wang owned or controlled.
Authorities also searched Wang’s residences and seized assets valued at about $30 million as well as identifying other property valued at roughly an additional $30 million, prosecutors said.
“The conduct alleged here reads like it’s ripped from a screenplay,” Matthew Axelrod, assistant secretary for export control at the Department of Commerce, said in a statement Wednesday. “A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate.”
The Department of Justice partnered with the FBI and international law enforcement agencies in Singapore, Thailand, and Germany to dismantle the botnet and arrest Wang. The case is the latest in the federal government’s ongoing effort to thwart global cybercrime, which has become increasingly widespread.
These crimes can range from intellectual property theft to ransomware and can cost businesses billions of dollars in losses in addition to threatening critical sectors across the country, according to the Department of State. In recent years, federal authorities have expanded their international operations and country-to-country partnerships in order to better address cyber threats.
‘Urgency and severity of cyberattacks’: EPA urges water utilities to protect nation’s drinking water amid heightened cyberattacks
911 S5 Botnet ‘likely the world’s largest botnet ever’
FBI Director Christopher Wray said in a statement Wednesday that 911 S5 is “likely the world’s largest botnet ever.” According to the indictment, Wang allegedly spread his malware through Virtual Private Network programs and pay-per-install services, which allowed him to manage and control the roughly 150 servers.
Paying customers were then given access to proxied IP addresses that were linked to the hacked devices, the indictment said. Cybercriminals used those addresses to hide their locations and “anonymously commit a wide array of offenses,” the Department of Justice alleged.
“These offenses including financial crimes, stalking, transmitting bomb threats and threats of harm, illegal exportation of goods, and receiving and sending child exploitation materials,” according to the department. “Since 2014, 911 S5 allegedly enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.”
Specifically, the botnet targeted COVID-19 pandemic relief programs and filed an estimated 560,529 fraudulent unemployment insurance claims, according to the indictment. Federal authorities confirmed that more than $5.9 billion was stolen as a result.
The indictment further alleged that Wang had amassed about $99 million — either in cryptocurrency or fiat currency — from his sales of the infected proxied IP addresses. He used the illicit proceeds to purchase luxury assets and property.
Wang bought property in the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates, according to the indictment. He also had dozens of other assets, such as luxury cars, watches, international bank accounts, and cryptocurrency wallets.
Wang was charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. He faces a maximum of 65 years in prison.
Cybercrime, COVID fraud in the U.S.
Cybercrime is a “significant and growing threat” to the country’s national and economic security, according to the State Department. As people become more dependent on information and communication technologies, the department said more criminals continue to shift online.
Wang’s arrest also comes amid a push from federal officials for organizations to update and follow cybersecurity guidelines. Federal agencies have issued multiple advisories for cyberattacks committed by foreign groups in recent years.
In January, the FBI and Department of Justice announced that they had “disrupted a botnet of hundreds of U.S.-based small office/home office routers hijacked” by China-linked hackers. The group, known as “Volt Typhoon,” targeted critical infrastructure organizations in the United States, such as water systems and electric grids.
The surge in malicious cyber incidents coincides with the rise in online communication during the COVID-19 pandemic, according to a 2023 cyberthreat study. Citing FBI data, the study said cybercrime increased by 400% during the pandemic.
“Cybercriminals find the uncertainty brought by changing daily habits opportune and the increased virtual existence is converted into available attack vectors,” the study noted.
In the four years since the onset of the pandemic, the Internal Revenue Service has investigated over 1,600 tax and money laundering cases related to COVID-19 fraud potentially worth about $8.9 billion, the agency said in March. Cases included fraudulently obtained loans, credits and payments meant for U.S. workers, families and small businesses under the Coronavirus Aid, Relief and Economic Security, or CARES, Act.
Contributing: Josh Meyer, USA TODAY
News
Apple, Google tell workers on visas to avoid leaving the U.S. amid Trump immigration crackdown
With reported months-long consulate and embassy delays, Google and Apple say employees on H-1B visas should stay put in the U.S. right now to avoid the risk of getting stranded abroad. The latter tech company’s headquarters campus is seen in Mountain View, Calif.
Justin Sullivan/Getty Images
hide caption
toggle caption
Justin Sullivan/Getty Images
Apple and Google are warning some U.S-based employees on visas against traveling outside of the country to avoid the risk of getting stuck coming back, as the Trump administration toughens vetting of visa applicants, according to recent internal memos from the tech companies that were reviewed by NPR.
U.S. consulates and embassies have been reporting lengthy, sometimes months-long delays, for visa appointments following new rules from the Department of Homeland Security requiring travelers to undergo a screening of up to five years’ of their social media history — a move criticized by free speech advocates as a privacy invasion.
For Apple and Google, which together employ more than 300,000 employees and rely heavily on highly-skilled foreign workers, the increased vetting and reports of extended delays were enough for the companies to tell some of their staff to stay in the U.S. if they are able to avoid foreign travel.
“We recommend avoiding international travel at this time as you risk an extended stay outside of the U.S.,” Berry Appleman & Leiden, a law firm that works with Google, wrote to employees.

The law firm Fragomen, which works with Apple, wrote a similar message: “Given the recent updates and the possibility of unpredictable, extended delays when returning to the U.S., we strongly recommend that employees without a valid H-1B visa stamp avoid international travel for now,” the memo read. “If travel cannot be postponed, employees should connect with Apple Immigration and Fragomen in advance to discuss the risks.”
Apple and Google declined to comment on the advisories, which were first reported by Business Insider.

It’s the latest sign of how the Trump administration’s aggressive immigration policies are affecting the foreign-born workforce in the U.S.
Earlier this year, the White House announced that companies will be subjected to a $100,000 fee for all new H-1B visas, a type of visa popular among tech companies eager to hire highly skilled workers from abroad.
H-1Bs typically last three years, and applicants have to return to an embassy or consulate in their home country for a renewal, but reports suggest such a routine trip could lead to people being stranded for months as a result of the Trump administration’s new policies.
On Friday, The Washington Post reported that hundreds of visa holders who traveled to India to renew their H-1Bs had their appointments postponed with the State Department explaining that officials needed more time to ensure that no applicants “pose a threat to U.S. national security or public safety.”
At Google, the Alphabet Workers’ Union has been campaigning for additional protections for workers on H-1B visas. Those workers would be particularly vulnerable in the event Google carried out layoffs, since losing employer sponsorship could jeopardize their legal status, said Google software engineer Parul Koul, who leads the union.
The need to support H-1B holders at Google, she said, has “only become more urgent with all the scrutiny and heightened vetting by the Trump administration around the H1B program, and how the administration is coming for all other types of immigrant workers.”
News
U.S. launches strikes in Syria targeting Islamic State fighters after American deaths
President Donald Trump and Defense Secretary Pete Hegseth salute as carry teams move the transfer cases with the remains of Iowa National Guard soldiers Sgt. William Nathaniel Howard, 29, of Marshalltown, Iowa, and Sgt. Edgar Brian Torres-Tovar, 25, of Des Moines, Iowa, and civilian interpreter Ayad Mansoor Sakat, who were killed in an attack in Syria, during a casualty return, Wednesday, Dec. 17, 2025 at Dover Air Force Base, Del.
Julia Demaree Nikhinson/AP
hide caption
toggle caption
Julia Demaree Nikhinson/AP
WASHINGTON — The Trump administration launched military strikes Friday in Syria to “eliminate” Islamic State group fighters and weapons sites in retaliation for an ambush attack that killed two U.S. troops and an American civilian interpreter almost a week ago.

A U.S. official described it as “a large-scale” strike that hit 70 targets in areas across central Syria that had IS infrastructure and weapons. Another U.S. official, who also spoke on condition of anonymity to discuss sensitive operations, said more strikes should be expected.
“This is not the beginning of a war — it is a declaration of vengeance. The United States of America, under President Trump’s leadership, will never hesitate and never relent to defend our people,” Defense Secretary Pete Hegseth said on social media.
The new military operation in Syria comes even as the Trump administration has said it’s looking to focus closer to home in the Western Hemisphere, building up an armada in the Caribbean Sea as it targets alleged drug-smuggling boats and vowing to keep seizing sanctioned oil tankers as part of a pressure campaign on Venezuela’s leader. The U.S. has shifted significant resources away from the Middle East to further those goals: Its most advanced aircraft carrier arrived in South American waters last month from the Mediterranean Sea.

Trump vowed retaliation
President Donald Trump pledged “very serious retaliation” after the shooting in the Syrian desert, for which he blamed IS. Those killed were among hundreds of U.S. troops deployed in eastern Syria as part of a coalition fighting the militant group.
During a speech in North Carolina on Friday evening, the president hailed the operation as a “massive strike” that took out the “ISIS thugs in Syria who were trying to regroup.”
Earlier, in his social media post, he reiterated his backing for Syrian President Ahmad al-Sharaa, who Trump said was “fully in support” of the U.S. effort.
Trump also offered an all-caps threat, warning IS against attacking American personnel again.
“All terrorists who are evil enough to attack Americans are hereby warned — YOU WILL BE HIT HARDER THAN YOU HAVE EVER BEEN HIT BEFORE IF YOU, IN ANY WAY, ATTACK OR THREATEN THE U.S.A.,” the president added.
The attack was conducted using F-15 Eagle jets, A-10 Thunderbolt ground attack aircraft and AH-64 Apache helicopters, the U.S. officials said. F-16 fighter jets from Jordan and HIMARS rocket artillery also were used, one official added.
U.S. Central Command, which oversees the region, said in a social media post that American jets, helicopters and artillery employed more than 100 precision munitions on Syrian targets.
How Syria has responded
The attack was a major test for the warming ties between the United States and Syria since the ouster of autocratic leader Bashar Assad a year ago. Trump has stressed that Syria was fighting alongside U.S. troops and said al-Sharaa was “extremely angry and disturbed by this attack,” which came as the U.S. military is expanding its cooperation with Syrian security forces.
Syria’s foreign ministry in a statement on X following the launch of U.S. strikes said that last week’s attack “underscores the urgent necessity of strengthening international cooperation to combat terrorism in all its forms” and that Syria is committed “to fighting ISIS and ensuring that it has no safe havens on Syrian territory and will continue to intensify military operations against it wherever it poses a threat.”
Syrian state television reported that the U.S. strikes hit targets in rural areas of Deir ez-Zor and Raqqa provinces and in the Jabal al-Amour area near the historic city of Palmyra. It said they targeted “weapons storage sites and headquarters used by ISIS as launching points for its operations in the region.”
IS has not said it carried out the attack on the U.S. service members, but the group has claimed responsibility for two attacks on Syrian security forces since, one of which killed four Syrian soldiers in Idlib province. The group in its statements described al-Sharaa’s government and army as “apostates.” While al-Sharaa once led a group affiliated with al-Qaida, he has had a long-running enmity with IS.
The Americans who were killed
Trump this week met privately with the families of the slain Americans at Dover Air Force Base in Delaware before he joined top military officials and other dignitaries on the tarmac for the dignified transfer, a solemn and largely silent ritual honoring U.S. service members killed in action.
The guardsmen killed in Syria last Saturday were Sgt. Edgar Brian Torres-Tovar, 25, of Des Moines, and Sgt. William Nathaniel Howard, 29, of Marshalltown. Ayad Mansoor Sakat, of Macomb, Michigan, a U.S. civilian working as an interpreter, also was killed.
The shooting near Palmyra also wounded three other U.S. troops as well as members of Syria’s security forces, and the gunman was killed. The assailant had joined Syria’s internal security forces as a base security guard two months ago and recently was reassigned because of suspicions that he might be affiliated with IS, Interior Ministry spokesperson Nour al-Din al-Baba has said.
The man stormed a meeting between U.S. and Syrian security officials who were having lunch together and opened fire after clashing with Syrian guards.
News
Trump’s push to end transgender care for young people opposed by pediatricians
A display at the Gender Health Program of Children’s Minnesota hospital. Under a proposed rule announced Thursday, a hospital will lose all its Medicaid and Medicare funding if it continues to provide gender-affirming care for trans people under age 18.
Selena Simmons-Duffin/NPR
hide caption
toggle caption
Selena Simmons-Duffin/NPR
Dr. Kade Goepferd watched the Trump administration’s moves on Thursday to ban gender-affirming care for transgender youth with “a mix of sadness and frustration.”
Goepferd, who is the founder of Children’s Minnesota Gender Health Program, says that for the medical community, nothing has changed about the evidence supporting gender-affirming care that could justify the government’s actions.

“There’s a massive propaganda and disinformation campaign that is selectively targeting this small population of already vulnerable kids and their families,” Goepferd says.
“Men are men”
Federal health officials said many times at Thursday’s announcement that their actions were driven by science and evidence, not politics or ideology. They frequently praised a report published by the Department of Health and Human Services in November. It concluded that clinicians who provide medical care to help youth transition have failed their patients and emphasized the benefits of psychotherapy as an alternative.
At times, health officials cast doubt on the idea that a person could be transgender at all.
“Men are men. Men can never become women. Women are women. Women can never become men,” said Acting CDC Director Jim O’Neill. He added that “the blurring of the lines between sexes” represented a “hatred for nature as God designed it.”
Health Secretary Robert F. Kennedy Jr. said doctors and medical groups had “peddled the lie” that these treatments could be good for children, and that those youth were “conditioned to believe that sex can be changed.”
Doctor groups disagree
The American Academy of Pediatrics, the medical group that represents 67,000 pediatricians across the country, pushed back forcefully on those characterizations.
“These policies and proposals misconstrue the current medical consensus and fail to reflect the realities of pediatric care and the needs of children and families,” said AAP President Dr. Susan J. Kressly in a statement. “These rules help no one, do nothing to address health care costs, and unfairly stigmatize a population of young people.”
AAP’s official position on this medical care is that it is safe and effective for the young people who need it. That view is shared by the American Medical Association, the Endocrine Society, among other medical organizations.
In a statement Thursday, the American Psychological Association wrote: “APA is deeply concerned about recent federal actions that not only challenge the scientific understanding of gender identity but also potentially jeopardize the human rights, psychological health, and well-being of transgender and nonbinary individuals.”
The most significant proposal released by HHS would withhold all Medicare and Medicaid funding from hospitals — a big portion of their budgets — if they provided gender-affirming care to those under age 18.
The Children’s Hospital Association said that rule — if finalized — would set a dangerous precedent. “Today’s proposed conditions make it possible for all kinds of specialized health care treatments to be withheld based on government-mandated rules,” wrote CEO Matthew Cook. “Millions of families could lose access to the care they need.”
After a 60-day comment period, the rules could be finalized and then take effect.
Attorneys general in New York and California have said they will fight these rules and protect the rights of trans people to get care in their states. The ACLU has vowed to sue, and more legal challenges are expected.
“I don’t want to be lost”
According to a CDC survey, about 3% of teenagers aged 13-17 identify as transgender, approximately 700,000 people. A poll from health research organization KFF found that less than a third of transgender people took medication related to their identity and 16% had had surgery.
For young people, medical options most commonly include puberty blockers and hormones. Surgery is very rare for minors. “This is health care that evolves over time, is individualized, tailored to a patient’s needs, often after years of relationship with a trusted health care team,” says Goepferd.
NPR spoke to a transgender 15-year old in California this week about the moves Trump administration officials were making to restrict care. “They think what I’m feeling is a phase and that my family should just wait it out and that it’s better I’m unhappy and never receive care,” he says. NPR agreed not to name him because of fears for his safety.
He says it can be difficult for those who are not transgender to understand that experience, but that, as far as he can tell, these health officials “are not interested in understanding trans people.”
He describes the long and deliberate process he made with his parents and doctors before he began taking testosterone. “The decision to not start gender-affirming care is often just as permanent as a decision to start it,” he says. “Not starting [hormone therapy], for some people, it feels like ruining our body, because there are certain changes we can never have.”
Now, after six months on testosterone, he feels like he’s on the right path, and is worried about the prospect of losing access to his medication if HHS’s efforts to shut down care nationally succeed. “It feels like someone’s throwing me into the bush just off the path I’m on, and that’s kind of terrifying,” he says. “I don’t want to be lost. I want to keep going where I’m going.”
“Deep moral distress”
More than half of states already ban gender-affirming care for young people after a frenzy of laws passed since 2021 in Republican-led states. This week, Republicans in the House led efforts to pass two federal bills that would restrict access to care, including one that could put doctors who provide the care in prison for up to ten years. It’s unclear if the bills will be voted on in the Senate.
Although nothing has officially changed in states where the care is still legal, these efforts to enact national restrictions have doctors and health systems in those states bracing for the possibility that their clinics will have to close down.
Dr. Kade Goepferd takes care of transgender and gender diverse young people at Children’s Minnesota hospital.
hide caption
toggle caption
“There’s a deep moral distress when you know that there is care that you can provide to young people that will measurably improve their health and the quality of their life, and you’re being restricted from doing that,” Goepferd of Children’s Minnesota says. “And there’s a moral distress in feeling like — as a hospital or a health care system — you have to restrict care that you’re providing to one population to remain financially viable to provide health care for other kids.”
-
Iowa6 days agoAddy Brown motivated to step up in Audi Crooks’ absence vs. UNI
-
Iowa1 week agoHow much snow did Iowa get? See Iowa’s latest snowfall totals
-
Maine4 days agoElementary-aged student killed in school bus crash in southern Maine
-
Maryland6 days agoFrigid temperatures to start the week in Maryland
-
Technology1 week agoThe Game Awards are losing their luster
-
South Dakota6 days agoNature: Snow in South Dakota
-
New Mexico4 days agoFamily clarifies why they believe missing New Mexico man is dead
-
Nebraska1 week agoNebraska lands commitment from DL Jayden Travers adding to early Top 5 recruiting class