News
Chinese national charged with operating ‘world’s largest botnet’ linked to billions in cybercrimes
Colonial Pipeline hack only latest in rising ransomware threats
Hackers hit hundreds of critical systems last year and watchdogs say we’re not doing enough head off more.
STAFF VIDEO, USA TODAY
A Chinese national has been arrested for his role in operating a residential proxy service that was used to defraud billions of dollars from the U.S. government and fund his lavish lifestyle, which included buying luxury cars and property around the world, the Department of Justice announced Wednesday.
YunHe Wang, 35, was arrested on May 24 and charged with creating a massive network of hijacked computer devices, also known as a “botnet,” that was used to conduct cyber attacks, fraud, child exploitation, bomb threats, and export violations, the department alleged. Wang administered the botnet, called “911 S5,” through about 150 servers worldwide from 2014 to 2022, according to an indictment unsealed last week.
About 76 of the servers were leased from online service providers based in the United States, the indictment said. The botnet infected over 19 million IP addresses in nearly 200 countries, including over 613,000 IP addresses located in the United States, according to prosecutors.
The Justice Department announcement comes after Wang and his two co-conspirators, Jingping Liu and Yanni Zheng, were sanctioned by the Department of Treasury for their alleged involvement with the malicious botnet. The department also imposed sanctions on three luxury companies Wang owned or controlled.
Authorities also searched Wang’s residences and seized assets valued at about $30 million as well as identifying other property valued at roughly an additional $30 million, prosecutors said.
“The conduct alleged here reads like it’s ripped from a screenplay,” Matthew Axelrod, assistant secretary for export control at the Department of Commerce, said in a statement Wednesday. “A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate.”
The Department of Justice partnered with the FBI and international law enforcement agencies in Singapore, Thailand, and Germany to dismantle the botnet and arrest Wang. The case is the latest in the federal government’s ongoing effort to thwart global cybercrime, which has become increasingly widespread.
These crimes can range from intellectual property theft to ransomware and can cost businesses billions of dollars in losses in addition to threatening critical sectors across the country, according to the Department of State. In recent years, federal authorities have expanded their international operations and country-to-country partnerships in order to better address cyber threats.
‘Urgency and severity of cyberattacks’: EPA urges water utilities to protect nation’s drinking water amid heightened cyberattacks
911 S5 Botnet ‘likely the world’s largest botnet ever’
FBI Director Christopher Wray said in a statement Wednesday that 911 S5 is “likely the world’s largest botnet ever.” According to the indictment, Wang allegedly spread his malware through Virtual Private Network programs and pay-per-install services, which allowed him to manage and control the roughly 150 servers.
Paying customers were then given access to proxied IP addresses that were linked to the hacked devices, the indictment said. Cybercriminals used those addresses to hide their locations and “anonymously commit a wide array of offenses,” the Department of Justice alleged.
“These offenses including financial crimes, stalking, transmitting bomb threats and threats of harm, illegal exportation of goods, and receiving and sending child exploitation materials,” according to the department. “Since 2014, 911 S5 allegedly enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.”
Specifically, the botnet targeted COVID-19 pandemic relief programs and filed an estimated 560,529 fraudulent unemployment insurance claims, according to the indictment. Federal authorities confirmed that more than $5.9 billion was stolen as a result.
The indictment further alleged that Wang had amassed about $99 million — either in cryptocurrency or fiat currency — from his sales of the infected proxied IP addresses. He used the illicit proceeds to purchase luxury assets and property.
Wang bought property in the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates, according to the indictment. He also had dozens of other assets, such as luxury cars, watches, international bank accounts, and cryptocurrency wallets.
Wang was charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. He faces a maximum of 65 years in prison.
Cybercrime, COVID fraud in the U.S.
Cybercrime is a “significant and growing threat” to the country’s national and economic security, according to the State Department. As people become more dependent on information and communication technologies, the department said more criminals continue to shift online.
Wang’s arrest also comes amid a push from federal officials for organizations to update and follow cybersecurity guidelines. Federal agencies have issued multiple advisories for cyberattacks committed by foreign groups in recent years.
In January, the FBI and Department of Justice announced that they had “disrupted a botnet of hundreds of U.S.-based small office/home office routers hijacked” by China-linked hackers. The group, known as “Volt Typhoon,” targeted critical infrastructure organizations in the United States, such as water systems and electric grids.
The surge in malicious cyber incidents coincides with the rise in online communication during the COVID-19 pandemic, according to a 2023 cyberthreat study. Citing FBI data, the study said cybercrime increased by 400% during the pandemic.
“Cybercriminals find the uncertainty brought by changing daily habits opportune and the increased virtual existence is converted into available attack vectors,” the study noted.
In the four years since the onset of the pandemic, the Internal Revenue Service has investigated over 1,600 tax and money laundering cases related to COVID-19 fraud potentially worth about $8.9 billion, the agency said in March. Cases included fraudulently obtained loans, credits and payments meant for U.S. workers, families and small businesses under the Coronavirus Aid, Relief and Economic Security, or CARES, Act.
Contributing: Josh Meyer, USA TODAY
News
Real estate investors are buying up long-term care facilities. Residents can suffer
Leslie Adams holds a photo of his mother, Shirley, who died after developing infected bedsores at a rehabilitation center, according to a lawsuit he filed. A court awarded the family $17 million, but they are still trying to collect it.
Taylor Glascock for KFF Health News
hide caption
toggle caption
Taylor Glascock for KFF Health News
By the time she was hospitalized in 2020, Pearlene Darby, a retired teacher, had suffered open sores on both legs, both hips, and both heels, as well as a five-inch-long gash on her tailbone. She died two weeks later at age 81 from infections and bedsores, according to her death certificate. Her daughter sued the nursing home, alleging it had left Darby sitting in her own feces and urine time and again.
The lawsuit, settled on confidential terms last year, blamed not only the managers of City Creek Post-Acute and Assisted Living but also the building’s owner, a real estate investment trust, or REIT. In the year Darby died, City Creek paid CareTrust REIT more than $1 million in rent, while the Sacramento, California, nursing home ran a deficit, court records show.
Federal tax rules ban REITs from running health care facilities, but CareTrust was not an absentee landlord either, according to internal records filed in the case. It chose the nursing home’s management company and required through the lease that the home keep at least 80% of beds occupied. CareTrust granularly tracked how well the home kept to its financial plan, down to the money spent monthly on nurses and food, the records said. And the documents showed that the real estate company kept tabs on government safety inspection findings and Medicare quality ratings.
Both CareTrust and the nursing home operator denied liability for Darby’s death. CareTrust officials said in court papers that it is not involved in day-to-day nursing home decisions or patient care, and that it monitors facilities to ensure nothing jeopardizes rent payments.
In a written statement, CareTrust Corporate Counsel Joseph Layne told KFF Health News: “We are the property owners, not the operators.”
Pearlene Darby, pictured here with her grandson Caleb Darby, was a resident of a Sacramento, California, nursing home. She died two weeks after being hospitalized for bedsores and an infection. The home denied liability and the case was settled out of court.
Shirlene Darby
hide caption
toggle caption
Shirlene Darby
Landlords with influence
Over the past decade, real estate investment trusts have bought thousands of buildings that house nursing homes, hospitals, assisted living facilities, and medical offices. A KFF Health News examination of court filings and corporate records shows that these landlords have more influence than the health care facilities publicly acknowledge.
The documents reveal REITs often select the management who oversee the operations and leave them in place even when they are aware of threadbare staffing, floundering governance, repeated safety violations, or other problems that hamper quality of care. A California jury in March awarded $92 million in punitive damages against a former REIT over the death of a 100-year-old resident with dementia who froze to death outside her assisted living facility.
“The REITs are in charge,” said Laraclay Parker, one of the lawyers who represent Darby’s daughter.
Absence of oversight
Despite their ubiquity, REITs remain invisible to state and federal health regulators. Hospitals and nursing homes are not required to disclose rent payments or landlord identities in the annual reports they submit to Medicare.
Under President Donald Trump, the Centers for Medicare & Medicaid Services indefinitely suspended a Biden-era requirement that nursing homes disclose REIT involvement. Catherine Howden, a CMS spokesperson, said in a statement that the agency does not regulate facilities based on their tax status or corporate form and instead focuses on the quality of the care they provide.
REITs now own a fifth of the nation’s senior housing, which includes assisted living, memory care, and independent living, according to an industry analysis. REITs also hold investments in 1 in 6 nursing homes. Publicly traded REITs that focus on health care are now worth nearly a quarter of a trillion dollars, according to Nareit, an industry association.
While one research study found REIT investments were associated with higher spending on nursing wages, another concluded that after being bought by REITs, nursing homes frequently replaced registered nurses with less skilled nurses and aides. A third analysis concluded that health inspection results were worse after REIT investment.
Researchers also found that investor-owned hospital chains that sold buildings to REITs were more likely to close or go bankrupt, as happened in 2024 with Steward Health Care. Often, private equity investors kept the sale proceeds as profits while the hospitals were burdened with new rent costs. “There were no improvements in clinical outcomes,” said Thomas Tsai, an associate professor at the Harvard T.H. Chan School of Public Health.
REITs are required to distribute most of their income and don’t have to pay the 21% federal corporate income tax on it. There is a catch: A REIT that “directly or indirectly operates or manages” a health care facility loses the tax break for five years. Typically, a REIT leases the property to another company that runs the nursing home or assisted living facility and maintains its tax break. Nareit said health care REITs distributed more than $7 billion in dividends in 2024.
Michael Stroyeck, head of health care analysis at Green Street, a real estate research company, said “there’s definitely a symbiotic relationship” between REITs and facility managers because they have the same goals. He said he has seen REITs replace operators that are having difficulties or go bankrupt.
John Kane, a senior vice president at the American Health Care Association and the National Center for Assisted Living, an industry group that represents nursing homes, said in a statement: “Given government funding often falls short, REITs have been valuable partners in helping to invest in long term care without influencing daily operations.”
Low staffing at a chain
Strawberry Fields REIT, which like CareTrust trades on the New York Stock Exchange, owns or controls the buildings of 131 nursing home facilities. The nursing home operations inside 66 of those facilities are owned by Moishe Gubin, Strawberry Fields’ chief executive, and Michael Blisko, one of its directors, according to Strawberry Fields’ annual report for last year.
Gubin and Blisko also jointly own Infinity Healthcare Management, which manages their nursing homes; Blisko is Infinity’s CEO. On average, Infinity-affiliated nursing homes provided an hour and a quarter less nursing care per resident per day than the national average of four hours, a KFF Health News analysis of federal records found.
Infinity and several of its nursing homes have recently settled 30 death and injury lawsuits in Cook County, Illinois, totaling more than $4 million, said Margaret Battersby Black, a Chicago lawyer. A jury last year awarded $12 million in a lawsuit brought against Infinity and one of its Chicago nursing homes over the 2023 death of Shirley Adams. A retired candy factory worker, Adams died after developing infected bedsores at Lakeview Rehabilitation and Nursing Center, according to the lawsuit.
“She had wounds that no one could explain,” one of her adult children, Leslie Adams, testified at trial. Medicare gives Lakeview its lowest quality rating, one star out of five.
Leslie Adams lost his mother, Shirley, who died after developing infected bedsores at Lakeview Rehabilitation and Nursing Center, according to a lawsuit he filed. “She had wounds that no one could explain,” he testified. (Taylor Glascock for KFF Health News)
Taylor Glascock for KFF Health News
hide caption
toggle caption
Taylor Glascock for KFF Health News
Paul Connery, a lawyer for Adams’ family, said they are still trying to collect on the judgment against the nursing home and management company, which now totals $17 million with interest and attorney fees.
“If I get caught speeding and I went to court, they issue me a ticket and I’ve got a fine to pay,” Adams said in an interview. “How are they able to still continue to move on with business like nothing has happened?”
In a phone interview and an email, Gubin said Strawberry Fields, Infinity, and the nursing homes are all legally distinct and that he has not played an active role in Infinity in more than a decade. He said nursing homes get sued all the time but that the verdict against Lakeview is so large that it will force the home to declare bankruptcy or shut down.
The owners and operators of Lakeview Rehabilitation and Nursing Center in Chicago also are directors of the real estate investment trust that owns the building, a securities filing shows.
Taylor Glascock for KFF Health News
hide caption
toggle caption
Taylor Glascock for KFF Health News
“The whole thing is unfortunate,” Gubin said by phone. “For 15 years they were a perfectly good guardian” and “a well-run building,” he said. “You wouldn’t think it was fair to be judged on your worst day.”
Blisko and an Infinity lawyer did not respond to requests for comment.
Strawberry Fields, which owns 10 assisted living facilities and two long-term care hospitals in addition to the nursing homes, earned net income last year of $33 million from $155 million in rent, a 21% profit margin, securities filings show. Gubin said those weren’t excessive returns.
A $110 million verdict
Traditionally, REIT leases make the operating companies responsible for paying property taxes, insurance premiums, and maintenance costs. In 2008, Congress gave health care REITs a new option to make money: On top of collecting rents, they could set up subsidiaries and take profits directly from health care businesses. They still must have independent management overseeing care decisions. Many REITs have embraced the role even though the subsidiaries must pay corporate taxes and risk losing money if the businesses do poorly.

Colony Capital was a REIT that through layers of shell corporations owned both the building and the operation of Greenhaven Estates, a Sacramento assisted living and memory care facility. In 2018 Greenhaven paid Colony $1.4 million in rent, nearly a third of its $4.5 million in revenue that year, according to financial records filed in court.
Greenhaven also was on the verge of losing its license, according to a revocation notice filed in November 2018 by the California Department of Social Services. Greenhaven had racked up years of health violations, including from letting untrained workers administer medications, lacking enough employees to care for people with dementia, and neglecting a resident who smeared feces over his body, bed, floor, and bathroom, the notice said.
In February 2019, a few weeks after celebrating her 100th birthday, Mildred Hernandez, a resident with Alzheimer’s, wandered out of Greenhaven in the middle of the night. Her assisted living wing had no exit door alarms even though it housed several residents with dementia, court records showed. Berta Lepe, one of Greenhaven’s caregivers, found Hernandez under a bush, wearing only a shirt and underwear. The temperature was in the 30s.
Mildred Hernandez was 100 when she died of hypothermia after wandering out of her assisted living facility in the middle of the night. A jury awarded $92 million in punitive damages against the owner of the home.
Ric Tapia
hide caption
toggle caption
Ric Tapia
“She was talking, but I couldn’t understand what she was saying,” Lepe testified at trial over a lawsuit from Hernandez’s family. Hernandez died of hypothermia a few hours later, according to her death certificate.
Frontier Management, the company that Colony had hired to manage Greenhaven, denied liability and settled the lawsuit on undisclosed terms.
Since the lawsuit, Colony has changed its name to DigitalBridge, which no longer owns Greenhaven and gave up its REIT status. At trial earlier this year, DigitalBridge said resident care was the responsibility of Frontier and that Colony “encouraged” Frontier to address problems. Richard Welch, a former Colony executive, testified that replacing management is disruptive. “I viewed it as a last resort,” he said.
In March, a jury awarded Hernandez’s family a total of $110 million: $10 million in compensatory damages, $92 million in punitive damages against DigitalBridge, and $8 million in punitive damages against Formation Capital, an asset management company.
“REIT money is very detached from knowing about or caring about patient or resident outcomes, because it’s not in their business model,” Ed Dudensing, a lawyer for the family, said in an interview. “Their allegiance is to their investors.”
DigitalBridge has asked the judge to delay finalizing the judgment while its legal challenges to the lawsuit and the verdict are evaluated. A DigitalBridge attorney and a corporate spokesperson did not respond to requests for comment, a Formation attorney declined comment, and a Frontier attorney and a spokesman did not respond to a request for comment.
‘Wet from head to toe’
When CareTrust bought City Creek Post-Acute and Assisted Living in 2019, the Sacramento nursing home where Pearlene Darby lived had a one-star Medicare rating and was losing money. CareTrust leased the building to a management company called Kalesta Healthcare Group based on the business plan Kalesta submitted.
While CareTrust was not the operator, it held periodic phone calls with Kalesta, which provided “a full update of what’s happening at the facility,” including changes in leadership, financial progress, and health inspection survey results, according to deposition testimony by Ryan Williams, a Kalesta co-founder.
According to a state inspection report, in 2020, the year Darby died, City Creek left a resident in soiled linens “wet from head to toe lying in bed” for more than eight hours. During a different visit, a health inspector cited the home after watching a nurse put a dirty diaper back onto a resident after caring for a wound. “It was just a small stool and it is far from where the wound is,” the nurse told the inspector, according to the report.
James Callister, CareTrust’s chief investment officer, said in his deposition that CareTrust officials “review results of regulatory surveys provided to us by the tenant. We review the five-star rating.” He said, “We evaluate results of care, but we do not evaluate types of care given or how or when, no.”
Darby had been living in City Creek since 2011 after a stroke left her in a wheelchair. She needed help getting in and out of bed. From September through November 2020, Darby lost 30 pounds, her family’s lawsuit alleged. During those months, employees dropped her three times as one worker rather than the required two operated the mechanical lift, the lawsuit said.
The suit alleged City Creek failed to reposition her every two hours in bed or her wheelchair, which is the clinical standard for people at risk of bedsores, and to promptly order devices to protect her skin.
In November, the nursing home sent Darby to the hospital. A blood test found bacteria had entered her bloodstream from her feces’ touching open skin wounds, according to the lawsuit. The hospital diagnosed her with sepsis. A surgeon said she needed an operation to redirect fecal waste from her intestines but concluded she wasn’t medically stable enough for surgery, the suit said.
Darby began receiving comfort care measures and was sent back to City Creek. She died two weeks later. In court filings, CareTrust and Kalesta denied the allegations.
In a phone interview, Williams, the Kalesta co-founder, said Darby’s death occurred during the most challenging point of the covid pandemic, when California rules required any nurses testing positive for the virus to be sent home and nurses were quitting out of fear for their health. “It was the most herculean of professional efforts to secure enough staff,” he said.
While expressing sympathy for Darby and her family, he said it was “unconscionable” that personal injury lawyers sued nursing homes over care failures during “the worst of times.”
In court, CareTrust petitioned Judge Richard Miadich to dismiss it from the lawsuit before trial. “This case does not concern a property condition,” CareTrust’s lawyers wrote. “CareTrust is simply a landlord.” But the judge ruled last year a jury should decide whether CareTrust “exercised actual control over City Creek.”
The case was settled out of court a few months later. All parties declined to reveal the settlement terms.
A 67% Profit
As recently as November 2023 — four years after its acquisition — City Creek earned one star from Medicare. It was cited for failing to have the minimum nursing home staffing required by California law during five of 24 randomly selected days in 2022, according to an inspection report. Williams said in the interview that Kalesta had increased spending on nursing over the course of its ownership, including boosting wages, but that it takes a year or two to turn around a troubled nursing home. He said the home’s star rating in 2023 was dragged down by its poor inspection history from before Kalesta took over.
City Creek’s rating has climbed in the past two years, and it now has the top overall rating of five, according to Medicare. Medicare rates City Creek’s current staffing levels as average. That’s better than most nursing homes in more than 200 buildings CareTrust bought before 2025, according to a KFF Health News analysis of federal data. On average, CareTrust nursing homes provided a half hour less nursing care per resident per day than the national average of four hours.
In its statement to KFF Health News, CareTrust’s counsel Layne said the REIT worked to “identify quality operators as tenants,” and that the homes the REIT rents out have more nurses and aides than the minimum required for nursing homes by their state governments. “The operators are licensed by state regulators and retain sole responsibility for operations,” the statement said.
CareTrust, which now owns more than 500 senior housing and nursing home buildings, reported net income last year of $320 million from $476 million in rents and other revenue — a 67% profit margin. As one point of comparison, HCA Healthcare, one of the nation’s largest for-profit hospital and health care chains, reported a 10% profit margin for last year.
Lesley Ann Clement, one of Darby’s lawyers, said cases like hers show the nursing home industry is wrong to complain it lacks financial resources for more staffing.
“There’s plenty of money,” Clement said. “They’re just not spending it on patient care.”
KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF — the independent source for health policy research, polling, and journalism.
News
US planning to seize Iran-linked ships in coming days, WSJ says | The Jerusalem Post
The US is planning to board and seize Iran-linked oil tankers and commercial ships in the coming days, according to a Saturday report by The Wall Street Journal.
The report noted that these actions would take place in international waters, potentially outside of the Middle East.
The US “will actively pursue any Iranian-flagged vessel or any vessel attempting to provide material support to Iran,” US Chairman of the Joint Chiefs of Staff Gen. Dan Caine said. “This includes dark fleet vessels carrying Iranian oil.”
“As most of you know, dark fleet vessels are those illicit or illegal ships evading international regulations, sanctions, or insurance requirements,” Caine continued.
Caine was further quoted as saying that the new campaign, which would be operated in part by the US Indo-Pacific Command, would be part of a broader US President Donald Trump-led campaign against Iran, known as “Economic Fury.”
White House spokeswoman Anna Kelly told the WSJ that Trump was “optimistic” that the new measures would lead to a peace deal.
The potential US military action comes as Iran tightens its grip on the Strait of Hormuz, including attacking several ships earlier on Saturday, the WSJ reported.
The report cited CENTCOM as saying that the US has already turned back 23 ships trying to leave Iranian ports since the start of its blockade on the Strait.
The expansion of naval action beyond the Middle East will provide the US with further leverage against Iran by allowing it to take control of a greater number of ships loaded with oil or weapons bound for Iran, the report noted.
“It’s a maximalist approach,” said associate professor of law at Emory University Law School Mark Nevitt. “If you want to put the screws down on Iran, you want to use every single legal authority you have to do that.”
Iran claimed earlier on Saturday that it had regained military control over the Strait, intending to hold it until the US guarantees full freedom of movement for ships traveling to and from Iran.
“As long as the United States does not ensure full freedom of navigation for vessels traveling to and from Iran, the situation in the Strait of Hormuz will remain tightly controlled,” the Iranian military stated.
In addition, Iranian Supreme Leader Mojtaba Khamenei declared on Saturday in an apparent message on his Telegram channel that the Iranian navy is prepared to inflict “new bitter defeats” on its enemies.
News
Video: The Origins of the Supreme Court’s Shadow Docket
new video loaded: The Origins of the Supreme Court’s Shadow Docket

By Jodi Kantor, Alexandra Ostasiewicz, June Kim and Luke Piotrowski
April 18, 2026
-
Science1 minute agoA renewed threat to JPL as the Trump administration tries again to cut NASA
-
Sports7 minutes agoAfter 55 years as a broadcaster in L.A., Randy Rosenbloom is leaving town
-
World19 minutes agoBulgaria votes in eighth election in five years
-
News49 minutes agoReal estate investors are buying up long-term care facilities. Residents can suffer
-
Detroit, MI3 hours agoFormer Piston shows Detroit what they’re missing as he dominates next to LeBron
-
San Francisco, CA3 hours agoEastbound I-80 closure in San Francisco snarls traffic, slows business
-
Videos3 hours agoCan Keir Starmer survive the latest Mandelson revelations? | BBC News
-
Dallas, TX3 hours agoPetar Musa’s Brace Not Enough as FC Dallas Draws LA Galaxy 2-2