News
Chinese national charged with operating ‘world’s largest botnet’ linked to billions in cybercrimes
Colonial Pipeline hack only latest in rising ransomware threats
Hackers hit hundreds of critical systems last year and watchdogs say we’re not doing enough head off more.
STAFF VIDEO, USA TODAY
A Chinese national has been arrested for his role in operating a residential proxy service that was used to defraud billions of dollars from the U.S. government and fund his lavish lifestyle, which included buying luxury cars and property around the world, the Department of Justice announced Wednesday.
YunHe Wang, 35, was arrested on May 24 and charged with creating a massive network of hijacked computer devices, also known as a “botnet,” that was used to conduct cyber attacks, fraud, child exploitation, bomb threats, and export violations, the department alleged. Wang administered the botnet, called “911 S5,” through about 150 servers worldwide from 2014 to 2022, according to an indictment unsealed last week.
About 76 of the servers were leased from online service providers based in the United States, the indictment said. The botnet infected over 19 million IP addresses in nearly 200 countries, including over 613,000 IP addresses located in the United States, according to prosecutors.
The Justice Department announcement comes after Wang and his two co-conspirators, Jingping Liu and Yanni Zheng, were sanctioned by the Department of Treasury for their alleged involvement with the malicious botnet. The department also imposed sanctions on three luxury companies Wang owned or controlled.
Authorities also searched Wang’s residences and seized assets valued at about $30 million as well as identifying other property valued at roughly an additional $30 million, prosecutors said.
“The conduct alleged here reads like it’s ripped from a screenplay,” Matthew Axelrod, assistant secretary for export control at the Department of Commerce, said in a statement Wednesday. “A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate.”
The Department of Justice partnered with the FBI and international law enforcement agencies in Singapore, Thailand, and Germany to dismantle the botnet and arrest Wang. The case is the latest in the federal government’s ongoing effort to thwart global cybercrime, which has become increasingly widespread.
These crimes can range from intellectual property theft to ransomware and can cost businesses billions of dollars in losses in addition to threatening critical sectors across the country, according to the Department of State. In recent years, federal authorities have expanded their international operations and country-to-country partnerships in order to better address cyber threats.
‘Urgency and severity of cyberattacks’: EPA urges water utilities to protect nation’s drinking water amid heightened cyberattacks
911 S5 Botnet ‘likely the world’s largest botnet ever’
FBI Director Christopher Wray said in a statement Wednesday that 911 S5 is “likely the world’s largest botnet ever.” According to the indictment, Wang allegedly spread his malware through Virtual Private Network programs and pay-per-install services, which allowed him to manage and control the roughly 150 servers.
Paying customers were then given access to proxied IP addresses that were linked to the hacked devices, the indictment said. Cybercriminals used those addresses to hide their locations and “anonymously commit a wide array of offenses,” the Department of Justice alleged.
“These offenses including financial crimes, stalking, transmitting bomb threats and threats of harm, illegal exportation of goods, and receiving and sending child exploitation materials,” according to the department. “Since 2014, 911 S5 allegedly enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.”
Specifically, the botnet targeted COVID-19 pandemic relief programs and filed an estimated 560,529 fraudulent unemployment insurance claims, according to the indictment. Federal authorities confirmed that more than $5.9 billion was stolen as a result.
The indictment further alleged that Wang had amassed about $99 million — either in cryptocurrency or fiat currency — from his sales of the infected proxied IP addresses. He used the illicit proceeds to purchase luxury assets and property.
Wang bought property in the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates, according to the indictment. He also had dozens of other assets, such as luxury cars, watches, international bank accounts, and cryptocurrency wallets.
Wang was charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. He faces a maximum of 65 years in prison.
Cybercrime, COVID fraud in the U.S.
Cybercrime is a “significant and growing threat” to the country’s national and economic security, according to the State Department. As people become more dependent on information and communication technologies, the department said more criminals continue to shift online.
Wang’s arrest also comes amid a push from federal officials for organizations to update and follow cybersecurity guidelines. Federal agencies have issued multiple advisories for cyberattacks committed by foreign groups in recent years.
In January, the FBI and Department of Justice announced that they had “disrupted a botnet of hundreds of U.S.-based small office/home office routers hijacked” by China-linked hackers. The group, known as “Volt Typhoon,” targeted critical infrastructure organizations in the United States, such as water systems and electric grids.
The surge in malicious cyber incidents coincides with the rise in online communication during the COVID-19 pandemic, according to a 2023 cyberthreat study. Citing FBI data, the study said cybercrime increased by 400% during the pandemic.
“Cybercriminals find the uncertainty brought by changing daily habits opportune and the increased virtual existence is converted into available attack vectors,” the study noted.
In the four years since the onset of the pandemic, the Internal Revenue Service has investigated over 1,600 tax and money laundering cases related to COVID-19 fraud potentially worth about $8.9 billion, the agency said in March. Cases included fraudulently obtained loans, credits and payments meant for U.S. workers, families and small businesses under the Coronavirus Aid, Relief and Economic Security, or CARES, Act.
Contributing: Josh Meyer, USA TODAY
In large cities and small towns across the country, millions took to the streets today in protest against the policies of President Trump and his administration.
Organized by “No Kings,” a network of progressive groups opposed to the administration’s agenda, the protests are the third wave of demonstrations since the President took office for a second term. Last year, millions attended protests in June and again in October.
Crowds assemble at the Embarcadero in San Francisco prior to the start of the protest.
Martin do Nascimento/KQED
hide caption
toggle caption
Martin do Nascimento/KQED
Thousands of community members marched in the flagship “No Kings” protest in St. Paul.
Jaida Grey Eagle/MPR News
hide caption
toggle caption
Jaida Grey Eagle/MPR News
Thousands sign a banner in Hartford at the Capitol that says “We the People.”
Tyler Russell/Connecticut Public
hide caption
toggle caption
Tyler Russell/Connecticut Public
Protesters hold signs and chant slogans in Driggs, Idaho.
Natalie Behring/Getty Images
hide caption
toggle caption
Natalie Behring/Getty Images
Demonstrators gather while holding signs near a roadside in Shelbyville, Kentucky.
Jon Cherry/Getty Images
hide caption
toggle caption
Jon Cherry/Getty Images
Demonstrators walk across the Memorial Bridge from Arlington, Virginia into Washington, DC.
Ken Cedeno/AFP
hide caption
toggle caption
Ken Cedeno/AFP
Demonstrators march down 7th Avenue and Broadway in Manhattan.
Spencer Platt/Getty Images
hide caption
toggle caption
Spencer Platt/Getty Images
![HARTFORD, CONNECTICUT, MARCH 28, 2026: Ken MacDonald tears up as he listens to a speech about the plight of his fellow veterans. “[Trump]’s playing with the lives of military people,” he said. Thousands rally at the “No Kings” protest at the capitol in Hartford on March 28, 2026. (Tyler Russell/Connecticut Public)](https://npr.brightspotcdn.com/dims3/default/strip/false/crop/6981x4654+0+0/resize/1100/quality/50/format/jpeg/?url=http%3A%2F%2Fnpr-brightspot.s3.amazonaws.com%2Feb%2F8b%2Fba7a9cb744baa343c85d45caf5ed%2F260328-nokingshartford-trb4371.jpg)
Ken MacDonald tears up in Hartford as he listens to a speech about the plight of his fellow veterans.
Tyler Russell/Connecticut Public
hide caption
toggle caption
Tyler Russell/Connecticut Public
A large crowd marches across the South First bridge toward a gathering at Auditorium Shores in Austin, Texas.
Patricia Lim/KUT News
hide caption
toggle caption
Patricia Lim/KUT News
Lindsay Holliday waves an American flag in Rosa Parks Square in Macon, Georgia.
Grant Blankenship/GPB News
hide caption
toggle caption
Grant Blankenship/GPB News
Demonstrators in downtown St. Louis walk by large banners decrying the U.S. conflict in Iran and U.S. Immigration and Customs Enforcement.
Brian Munoz/St. Louis Public Radio
hide caption
toggle caption
Brian Munoz/St. Louis Public Radio
Kat Carves works on a ice sculpture that says ‘End Ice’ ahead of the rally on the Boston Common in Boston.
Arthur Mansavage/GBH News
hide caption
toggle caption
Arthur Mansavage/GBH News
Protestors march across an overpass near the Georgia state Capitol building in Atlanta.
Elijah Nouvelage/AFP
hide caption
toggle caption
Elijah Nouvelage/AFP
Protesters hold a banner reading “End the wars, stop ICE, general strike” at Embarcadero Plaza in San Francisco.
Gustavo Hernandez/KQED
hide caption
toggle caption
Gustavo Hernandez/KQED
Maria Perry, left, and John Stock, right, joined protesters gathering in Mill Creek Park in Kansas City, Missouri.
Julie Denesha/KCUR
hide caption
toggle caption
Julie Denesha/KCUR
Duane Inge, a 63-year-old demonstrator, protests in front of Busch Stadium in downtown St. Louis.
Brian Munoz/St. Louis Public Radio
hide caption
toggle caption
Brian Munoz/St. Louis Public Radio
A protestor wears a “Let’s be brave” pin at a rally in Richmond, Virginia.
Shaban Athuman/VPM
hide caption
toggle caption
Shaban Athuman/VPM
Demonstrators in costumes stand along the National Mall in Washington, DC.
Ken Cedeno/AFP
hide caption
toggle caption
Ken Cedeno/AFP
Protestors listens as speakers address the crowd gathered in Richmond, Virginia.
Shaban Athuman/VPM News
hide caption
toggle caption
Shaban Athuman/VPM News
Protesters descend on Times Square in New York City.
Charly Triballeau/AFP
hide caption
toggle caption
Charly Triballeau/AFP
Demonstrators begin to march from the Western Sculpture Garden at the Minnesota State Capitol in St. Paul.
Steven Garcia/Minnesota Public Radio
hide caption
toggle caption
Steven Garcia/Minnesota Public Radio
Thousands march towards the Steel Bridge from the waterfront in Portland, Oregon.
Saskia Hatvany/OPB
hide caption
toggle caption
Saskia Hatvany/OPB
Two students were killed and at least seven other people were injured after a school bus crash in Tennessee on Friday, officials said.
The school bus was carrying 25 students and five adults from Kenwood Middle School in Clarksville for a field trip in Jackson, Tennessee, the school district said in a statement.
The crash, which remains under investigation, involved a Tennessee Department of Transportation dump truck, a Chevrolet Trailblazer and the school bus. It happened around noon on Highway 70 in Carroll County, said Maj. Travis Plotzer, a spokesperson for the Tennessee Highway Patrol.
Plotzer said there were two adults in the TDOT vehicle and one person in the Chevrolet Trailblazer. He said the crash is “a parent’s worst nightmare.”
The cause of the crash is under investigation.
At least seven people who were injured were taken by air ambulance to hospitals across Tennessee, including Memphis and Nashville, CBS affiliate WREG reported. The extent of their injuries was not immediately disclosed.
The school’s principal, Karen Miller, said counselors will be available starting Monday. In a written message to families shared on Facebook, she called the crash an unimaginable tragedy and encouraged parents to be attentive to their child’s emotional needs as they process the deaths of their classmates.
“Please continue to pray with us for our students, families, faculty, and staff,” Miller wrote. “I am grateful for the strength of our Kenwood community, and I trust we will all support each other during this difficult time.”
Four people were taken to Monroe Carell Jr. Children’s Hospital at Vanderbilt in Nashville and were in stable condition Friday, according to a Vanderbilt Health spokesperson.
Another 19 people were taken to Baptist Memorial Hospital-Carroll County, said Kim Alexander, a spokesperson for Baptist Memorial Health Care. All were evaluated and released, though it was unclear how many actually were injured, she said.
CBS affiliate WTVF reported the school bus was on the way to participate in the Toyota Hub City Grand Prix Greenpower USA race in Jackson. The Jackson-Madison County superintendent said in a statement that they were “completely devastated” by the crash and called the loss “immeasurable,” WTVF reported.
The school district was hosting the event.
Police detain Nerdeen Kiswani, an organizer of pro-Palestinian demonstration group “Within Our Lifetime” during a protest on Friday, April 12, 2024, in New York.
Yuki Iwamura/AP
hide caption
toggle caption
Yuki Iwamura/AP
NEW YORK — A man accused of planning to firebomb the home of a prominent Palestinian activist has been arrested following a weekslong undercover operation led by the New York City Police Department, officials said Friday.
The target of the plot was Nerdeen Kiswani, who frequently leads protests in New York against Israel and the war in Gaza through the organization Within Our Lifetime.
Kiswani, 31, said law enforcement officials informed her late Thursday that they had disrupted “a threat on my life that was about to take place.”
Federal authorities said they arrested Alexander Heifler on Thursday at his home in Hoboken, New Jersey, as he was assembling Molotov cocktails that he planned to throw at Kiswani’s home. For weeks, he had discussed the plot with an undercover NYPD detective who had infiltrated a group chat used by Heifler, according to a police department spokesperson.
An official who was briefed on the investigation said Heifler, 26, identified as a member of the JDL 613 Brotherhood, a New Jersey-based group founded in 2024 that describes its membership as “Jewish warriors” fighting back against rising antisemitism.
A website for the group says they are inspired by the original Jewish Defense League, a group linked to numerous bombings and attempted assassinations of Arab American political activists in the 1970s and 1980s.
Heifler planned to flee to Israel following the attack, according to the official, who requested anonymity because they were not authorized to discuss the details of an ongoing investigation.
An email inquiry sent to the JDL 613 was not returned.
Kiswani, who lives in Brooklyn with her infant son and husband, said the plot would not deter her continued activism.
“I feel very blessed that they were able to thwart this, but it’s something that is a constant possibility for people who speak up on behalf of Palestine,” she said.
Heifler was charged in a criminal complaint with separate counts of making and possessing destructive devices, which each carry a maximum penalty of 10 years in prison. A message left with his attorney was not returned. He made an initial appearance in New Jersey federal court on Friday afternoon.
“Let me be clear: We will not tolerate violent extremism in our city,” New York City Mayor Zohran Mamdani said in a statement. “No one should face violence for their political beliefs or their advocacy. I am relieved that Nerdeen is safe.”
According to a court filing written by an FBI agent, Heifler spoke on a video call in February with a group that included an undercover detective about his interest in training for “self-defense” and wanting space where he could throw Molotov cocktails.
The next day, he met with the undercover detective in person and discussed his plan to use them against Kiswani and flee the country, according to the complaint. “We have (Kiswani’s) address,” Heifler allegedly told the undercover. “So it’s like that, that would be easier if you’d be more comfortable with that.”
Heifler and the undercover detective drove to Kiswani’s residence on March 4 to “conduct surveillance” and discussed making a dozen Molotov cocktails to throw at her home and two cars parked outside, complaint said.
On Thursday, the undercover detective and Heifler met at Heifler’s Hoboken residence, where he had assembled components to make the Molotov cocktails, including a large bottle of Everclear, a highly flammable alcohol, the complaint said. Law enforcement officers then executed a search warrant at the residence and recovered the eight Molotov cocktails, the complaint said.
Kiswani co-founded the group Within Our Lifetime, which frequently organizes protests against Israel that draw hundreds of participants and often end in arrests. The group’s calls to “abolish Zionism” and support for “all forms of struggle,” including violence, has drawn fierce criticism. Kiswani denies that her criticism of Israel amounts to antisemitism.
Kiswani has been a frequent target of online vitriol. Earlier this year, U.S. Rep. Randy Fine, a Florida Republican, sparked backlash after writing in a social media post that “the choice between dogs and Muslims is not a difficult one.” The post was a response to a message Kiswani shared about dog owners, which she said was a light joke.
“That hate against Palestinians has been bolstered by public officials, by Zionist organizations, who are never held accountable,” she said. “This is the inevitable result of that.”
The operation was carried out by the Racially and Ethnically Motivated Extremism unit within the NYPD’s counterterrorism bureau, a police spokesperson said.
“This is exactly how our intelligence and counterterrorism operation is designed to work — a sophisticated apparatus built to detect danger early and prevent violence before it reaches our streets,” Police Commissioner Jessica Tisch said.
Trump’s Ballroom Design Has Barely Been Scrutinized
‘The Comeback’ is back. That’s something to Cherish
The best deals we’ve found from Amazon’s Big Spring Sale (so far)
Zelenskyy offers cutting-edge drone defense to Gulf allies as Ukraine seeks missile support
JD Vance says he was ‘obsessed’ with UFOs, believes aliens are actually ‘demons’
Florida High School Football Rankings: Top 25 teams – Oct. 21
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
99th annual Pony Swim held in Virginia
Indiana Members Credit Union announced as new anchor tenant at Bottleworks District
JD Vance says he was ‘obsessed’ with UFOs, believes aliens are actually ‘demons’
The EU's recipe for trade deals : easy on beef, tough on wine
Photos: ‘No Kings’ protests across the country
Jeffries declines to break with indicted Democrat after ethics panel’s guilty verdict
Hundreds of thousands march through London in stand against the far right
-
Sports1 week agoIOC addresses execution of 19-year-old Iranian wrestler Saleh Mohammadi
-
New Mexico6 days agoClovis shooting leaves one dead, four injured
-
Tennessee5 days agoTennessee Police Investigating Alleged Assault Involving ‘Reacher’ Star Alan Ritchson
-
Technology7 days agoYouTube job scam text: How to spot it fast
-
Minneapolis, MN3 days agoBoy who shielded classmate during school shooting receives Medal of Honor
-
Texas1 week agoHow to buy Houston vs. Texas A&M 2026 March Madness tickets
-
Science1 week agoRecord Heat Meets a Major Snow Drought Across the West
-
Politics1 week agoSchumer gambit fails as DHS shutdown hits 36 days and airport lines grow