Connect with us

News

Chinese national charged with operating ‘world’s largest botnet’ linked to billions in cybercrimes

Published

on

Chinese national charged with operating ‘world’s largest botnet’ linked to billions in cybercrimes
play

A Chinese national has been arrested for his role in operating a residential proxy service that was used to defraud billions of dollars from the U.S. government and fund his lavish lifestyle, which included buying luxury cars and property around the world, the Department of Justice announced Wednesday.

YunHe Wang, 35, was arrested on May 24 and charged with creating a massive network of hijacked computer devices, also known as a “botnet,” that was used to conduct cyber attacks, fraud, child exploitation, bomb threats, and export violations, the department alleged. Wang administered the botnet, called “911 S5,” through about 150 servers worldwide from 2014 to 2022, according to an indictment unsealed last week.

Advertisement

About 76 of the servers were leased from online service providers based in the United States, the indictment said. The botnet infected over 19 million IP addresses in nearly 200 countries, including over 613,000 IP addresses located in the United States, according to prosecutors.

The Justice Department announcement comes after Wang and his two co-conspirators, Jingping Liu and Yanni Zheng, were sanctioned by the Department of Treasury for their alleged involvement with the malicious botnet. The department also imposed sanctions on three luxury companies Wang owned or controlled.

Authorities also searched Wang’s residences and seized assets valued at about $30 million as well as identifying other property valued at roughly an additional $30 million, prosecutors said.

“The conduct alleged here reads like it’s ripped from a screenplay,” Matthew Axelrod, assistant secretary for export control at the Department of Commerce, said in a statement Wednesday. “A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate.”

Advertisement

The Department of Justice partnered with the FBI and international law enforcement agencies in Singapore, Thailand, and Germany to dismantle the botnet and arrest Wang. The case is the latest in the federal government’s ongoing effort to thwart global cybercrime, which has become increasingly widespread.

These crimes can range from intellectual property theft to ransomware and can cost businesses billions of dollars in losses in addition to threatening critical sectors across the country, according to the Department of State. In recent years, federal authorities have expanded their international operations and country-to-country partnerships in order to better address cyber threats.

‘Urgency and severity of cyberattacks’: EPA urges water utilities to protect nation’s drinking water amid heightened cyberattacks

911 S5 Botnet ‘likely the world’s largest botnet ever’

FBI Director Christopher Wray said in a statement Wednesday that 911 S5 is “likely the world’s largest botnet ever.” According to the indictment, Wang allegedly spread his malware through Virtual Private Network programs and pay-per-install services, which allowed him to manage and control the roughly 150 servers.

Paying customers were then given access to proxied IP addresses that were linked to the hacked devices, the indictment said. Cybercriminals used those addresses to hide their locations and “anonymously commit a wide array of offenses,” the Department of Justice alleged.

Advertisement

“These offenses including financial crimes, stalking, transmitting bomb threats and threats of harm, illegal exportation of goods, and receiving and sending child exploitation materials,” according to the department. “Since 2014, 911 S5 allegedly enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.”

Specifically, the botnet targeted COVID-19 pandemic relief programs and filed an estimated 560,529 fraudulent unemployment insurance claims, according to the indictment. Federal authorities confirmed that more than $5.9 billion was stolen as a result.

The indictment further alleged that Wang had amassed about $99 million — either in cryptocurrency or fiat currency — from his sales of the infected proxied IP addresses. He used the illicit proceeds to purchase luxury assets and property.

Wang bought property in the United States, St. Kitts and Nevis, China, Singapore, Thailand, and the United Arab Emirates, according to the indictment. He also had dozens of other assets, such as luxury cars, watches, international bank accounts, and cryptocurrency wallets.

Wang was charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. He faces a maximum of 65 years in prison.

Advertisement

Cybercrime, COVID fraud in the U.S.

Cybercrime is a “significant and growing threat” to the country’s national and economic security, according to the State Department. As people become more dependent on information and communication technologies, the department said more criminals continue to shift online.

Wang’s arrest also comes amid a push from federal officials for organizations to update and follow cybersecurity guidelines. Federal agencies have issued multiple advisories for cyberattacks committed by foreign groups in recent years.

In January, the FBI and Department of Justice announced that they had “disrupted a botnet of hundreds of U.S.-based small office/home office routers hijacked” by China-linked hackers. The group, known as “Volt Typhoon,” targeted critical infrastructure organizations in the United States, such as water systems and electric grids.

The surge in malicious cyber incidents coincides with the rise in online communication during the COVID-19 pandemic, according to a 2023 cyberthreat study. Citing FBI data, the study said cybercrime increased by 400% during the pandemic.

Advertisement

“Cybercriminals find the uncertainty brought by changing daily habits opportune and the increased virtual existence is converted into available attack vectors,” the study noted.

In the four years since the onset of the pandemic, the Internal Revenue Service has investigated over 1,600 tax and money laundering cases related to COVID-19 fraud potentially worth about $8.9 billion, the agency said in March. Cases included fraudulently obtained loans, credits and payments meant for U.S. workers, families and small businesses under the Coronavirus Aid, Relief and Economic Security, or CARES, Act.

Contributing: Josh Meyer, USA TODAY

News

The Real Love Company made her feel whole. Then ‘Daddy’ said to strip naked.

Published

on

The Real Love Company made her feel whole. Then ‘Daddy’ said to strip naked.

Kim was, in her words, “starving for that fatherly love.”

She became an intern for Baer and always looked forward to being held in his arms for extended periods of time. She eventually asked him if there was anything she could do to help ease the fear that she believed was still holding her back.

There was, Baer told her. At his direction, she took off her top and bra, Kim said, and he held her but didn’t touch her breasts or privates.

“It felt very parental, and it felt very special,” she said.

In hindsight, Kim said, she cherished the experience for another reason.

Advertisement

“I was getting this special attention from him,” she said. “I was pretty desperate for that in my life.”

She now sees it as classic grooming behavior.

It happened one other time, Kim said, and she eventually asked him if there was anything else she could do to experience a “bigger shift.”

Baer brought her to the pool house and instructed her to remove her clothes piece by piece, Kim said. He lay in bed with her, rubbed her back and held her breasts, according to Kim.

“There was no talking me into it — I just did it,” Kim said. “In hindsight, I realized I didn’t feel free to say no to any of it. I had the belief that if I did say no, he would write me off.”

Advertisement

When Kim got the call from her daughter Penelope, she said it jolted her out of what she now describes as a cult mindset.

She spoke to other women in the community and said she heard more stories involving naked holding.

One of those women was Inge Jechart. A mother of two with a doctorate in physics, Inge had been an active Real Love member since a friend recommended Baer around 2005.

Baer and Inge Jechart.Courtesy Inge Jechart

“At that time, I was lost and lonely,” she said, describing struggling under the weight of a faltering marriage and a strained relationship with her sons. “I learned how to become a better person and more loving and understanding.”

The first time Baer held her in his lap, Inge was overcome with emotion.

Advertisement

“I just cried,” Inge recalled. “It was such a relief to feel safe and loved. What else do we want in life?”

Following that experience, Inge said, she booked every retreat at his house that she could. And it was there, in 2017, that she said she twice got naked with Baer at his direction.

“We hold our own children when they’re naked to make them feel safe,” Inge said. “For me, that’s what we were doing.”

“And here’s the thing,” she added. “It made a huge difference for me.”

But Inge said Baer fondled her breasts the second time, and that didn’t feel right at all.

Advertisement

“I said, ‘Hey, as a 4-year-old, I wouldn’t have breasts,’” she recalled. “And he stopped.”

Inge said Baer told her he had done it with only one other woman before, and he added in a stern voice: “I don’t talk about this with anyone else.”

“I got the message,” Inge said. “Our community was important to me, and I didn’t want it to blow up, so I kept silent.”

But she said she never considered that he might be engaging in naked holding with younger, more impressionable women like Veena and Penelope.

Kim, Penelope’s mother, said the same.

Advertisement

“It had never crossed my mind that he would ever do this with my daughter,” Kim said. “I was completely blind to that possibility.”

The backlash

In February 2019, Kim sat down at her computer and began to type an email to Baer.

“Greg what you have done with my daughter…is wrong, hurtful, traumatic and goes against so many gospel principles,” read the email, which was reviewed by NBC News.

“Holding people without clothes on needs to stop, what you are doing is wrong,” it added. “Touching my daughter between her legs when she was naked was wrong — there is no justification for it.”

“I know of 4 women personally who have undressed completely with you, and I don’t know hardly anyone that you spend time with so I conjecture that there are many more,” Kim wrote near the end. “I beg of you…put a stop to this horribly damaging behavior.”

Advertisement

Baer was defiant in his response.

Kim’s daughter was “claiming events that never happened,” he wrote. “And she is supplying lots of details that never happened. And now she is sharing these details with as many people as she can find.”

Kim’s email wasn’t the only scathing message Baer received during this period.

“I am writing to perhaps appeal to your consciences and any integrity you may still have left,” wrote a woman from the U.K. in an email viewed by NBC News. “Shut Real Love down now before it’s too late.”

“Greg you have had sexual dealings with way more women than we initially thought,” the woman added. “That’s not including the naked holding.”

Advertisement

Baer replied with another strong denial.

“Nothing, absolutely nothing, like this is occurring, and people are healing all over the place,” he wrote to the British woman.

After receiving an email from NBC News, the woman declined to be interviewed, citing the lasting emotional toll.

“It’s honestly an incredibly traumatic part of my life, and one I don’t want to revisit,” she wrote. “It’s been 8 years and I haven’t moved on.”

The aftermath

Veena, Penelope and her mother said they all reached out to the police in Baer’s hometown of Rome but were told there was not enough evidence to pursue a sexual abuse case.

Advertisement

The Rome Police Department confirmed to NBC News that it conducted an investigation but said no charges were brought due to “insufficient probable cause.”

The women said they had also reported Baer to their local Mormon churches.

Veena at home in New York.
Veena at home in New York.Vanessa Leroy / NBC News

A spokesman for the Church of Jesus Christ of Latter-day Saints, widely known as the Mormon church, said it “initiated ecclesiastical proceedings involving this individual beginning in February 2020.”

The process could lead to a member’s excommunication, but the spokesman said he was not authorized to comment on the outcome of the proceedings.

Veena and Penelope filed lawsuits against Baer in Georgia’s Floyd County Superior Court in April 2019. They were settled five months later for $12,000 each. (The attorney who represented Baer, Robert Smalley, declined to comment.)

By then, Veena was adapting to life outside of Real Love. She had already separated from her husband and left the church. While raising her three children, she went back to college. A career in physics no longer interested her. She earned a degree in psychology from Columbia University.

Advertisement

“To help me understand what on earth just happened,” Veena said.

A few years ago, she decided to write what became a very different book than the one originally conceived about her experience in Real Love. She used pseudonyms for the group and for Baer himself, but the account, she said, was drawn from her recollections, emails and journal entries.

“The True Happiness Company” was published last year with the subtitle, “How a Girl Like Me Falls for a Cult Like That.”

Veena's memoir,
Veena’s memoir, “The True Happiness Company,” which details her time with Real Love.Vanessa Leroy / NBC News

Veena hoped that it would help her process what happened and serve as a cautionary tale for others.

“The physical violation is not what unravels me,” she says in the book. “It’s the loss of life experience, the mental and emotional violation of having my young adulthood orchestrated by someone with undue influence over me. It’s the friendships that disintegrated. The career paths unexplored. The opinions he replaced with his own.”

“The changes feel almost imperceptible as they happen,” she added later in the book, “and then suddenly appear extreme in retrospect.”

Advertisement

If you or someone you know is in crisis, call or text 988 or go to 988lifeline.org to reach the 988 Suicide & Crisis Lifeline, or visit SpeakingOfSuicide.com/resources.

Continue Reading

News

Air Force One, gifted to Trump from Qatar, arrives at Joint Base Andrews

Published

on

Air Force One, gifted to Trump from Qatar, arrives at Joint Base Andrews

U.S. President Donald Trump pumps his fist after touring the inside of the newest aircraft in the presidential fleet at Andrews Air Force Base on June 19, 2026 at Joint Base Andrews, Maryland.

Alex Wong
/Getty Images


hide caption

toggle caption

Advertisement

Alex Wong
/Getty Images

The newest Air Force One jet, gifted to President Trump from the Qatari government, arrived ahead of schedule on Friday to Joint Base Andrews in Maryland.

On Friday afternoon, Trump toured the luxury Boeing 747 plane that initially stirred controversy. The plane was one of the biggest foreign gifts ever received by the U.S. government and raised legal and ethical questions after Qatar offered to replace the presidential jet last year. Trump said last May he’d be “stupid” not to accept the offer. Industry groups originally said the plane could be worth approximately $400 million.

Trump also spoke standing in front of the plane, thanking the Emir of Qatar.

Advertisement

The president praised the workmanship of the plane, describing it as the “world’s most luxurious plane.” He also called it the “largest Air Force One ever built,” adding “it flies further and faster than any Air Force One.”

“This plane was transformed into a flying White House at a level of luxury that nobody’s ever seen before, probably even almost outside of an airplane,” Trump said. “Nobody’s ever seen anything like this, and in only 10 months, a timeframe no one thought possible.”

The exterior of the jet is no longer light blue, silver, and white – a fixture since the Kennedy administration. Trump unveiled the new red, white and blue color scheme. 

“It was time for a change. … Everything was designed good. It was my taste,” Trump said saying that he approved the new color scheme, which reflects the American flag.

The VC-25B Bridge aircraft will now undertake its commissioning flights, what the Air Force calls a “final exam” for the plane. The plane was modified after serving the Qatari Head of State.

Advertisement

“Once these flights are successfully completed, the aircraft is officially ‘commissioned’ into the active executive airlift fleet and becomes available for presidential missions,” an Air Force press release said.

Continue Reading

News

Algae clouded Trump’s vision for the Reflecting Pool. But scientists aren’t surprised

Published

on

Algae clouded Trump’s vision for the Reflecting Pool. But scientists aren’t surprised

Algae turns the newly repainted Lincoln Memorial Reflecting Pool green on the National Mall on Tuesday in Washington, DC.

Chip Somodevilla/Getty Images


hide caption

toggle caption

Advertisement

Chip Somodevilla/Getty Images

WASHINGTON — The Lincoln Memorial reflecting pool is once again making headlines, this week for turning green.

The Washington, D.C. landmark was refilled with water earlier this month after President Trump had its neutral grey bottom repainted “American flag blue.” The multi-million dollar project produced subtle results in the eyes of many observers, even as Trump and Secretary of the Interior Doug Burgum — whose agency managed the renovation — touted its success.

In recent days, however, the pool has taken on a verdant hue — the result of algae blooms that experts say are to be expected in these conditions.

Advertisement

“It’s called ‘New Pond Syndrome,’” says Steve Goodale, a Canadian swimming pool specialist known online as “Swimming Pool Steve.” “It’s a known thing that happens when you take a natural, clear body of water like this that sits in an open air environment and you try to start it up, very often you end up with green water almost immediately.”

Goodale says the process took longer — a matter of days — to unfold in this case likely due to the sheer size of the pool, which measures 2,030 feet long and has a surface area of approximately 338,000 square feet.

“Excellent conditions” for algae growth

Rosalina Stancheva Christova, a professor of aquatic ecology at George Mason University in Virginia, took water samples from the pool on Tuesday. She confirmed the algae belongs to the genus Desmodesmus, which she said is “growing in excessive amounts” but is not toxic or harmful.

Christova says this kind of common green algae is found all over the region, especially this time of year. The reflecting pool in particular provides “excellent conditions” for algae growth, she said: shallow, stagnant water, strong sunlight and no shade.

“It could happen every single summer,” she added. “But it seems that the disturbance of the pond during the renovations [is] accelerating this process.”

Advertisement

Christova said last month’s renovations may have affected the balance of nutrients in the pool, potentially accelerating the algae blooms. Goodale similarly views the resurfacing as one of several contributing factors.

“The new, darker interior surface is going to absorb more sunlight,” Goodale says. “It is going to result in water that’s warmer, and that ultimately is going to lead to more prolific algae growth.”

A microscopic slide shows the Desmodesmus algae that quickly turned the Reflecting Pool's water green. The new dark blue paint of the pool's lining makes the water warmer and friendlier to the algae growth.

A microscopic slide shows the Desmodesmus algae that quickly turned the Reflecting Pool’s water green. The new dark blue paint of the pool’s lining makes the water warmer and friendlier to the algae growth.

Rosalina Stancheva Christova, PhD.


hide caption

Advertisement

toggle caption

Rosalina Stancheva Christova, PhD.

The Trump administration has said the algae came from residual material in supply lines that had lain dormant for weeks. Their growth was likely exacerbated by the extreme temperatures that hit D.C. last week, bringing heat index values to 95 degrees and above.

Continue Reading
Advertisement

Trending