The U.S. Department of the Treasury imposed sanctions on three Chinese citizens and the three Thai companies they own on Tuesday (May 28), accusing them of involvement in cybercrime activities, issuing bomb threats, and fraudulently applying for COVID-related aid, resulting in government losses of billions of dollars.
The three Chinese individuals sanctioned are Yunhe Wang, Jingping Liu, and Yanni Zheng.
The three Thai companies sanctioned are Spicy Code Company Limited, Tulip Biz Pattaya Group Company Limited, and Lily Suites Company Limited. These companies are owned or controlled by Yunhe Wang.
According to the Treasury Department, these individuals and Thai companies are related to the 911 S5 zombie network activities. They use the 911 S5 zombie network to infiltrate victims’ computers and mask digital footprints, leading their cybercrime activities to be traced back to the victims’ computers rather than their own devices.
Brian Nelson, Deputy Assistant Secretary for Terrorism and Financial Intelligence at the U.S. Department of the Treasury, stated, “These individuals leverage their malicious zombie network technology to infiltrate personal devices, allowing cyber criminals to fraudulently obtain economic assistance that should be provided to those in need, and to intimidate our citizens through bomb threats.”
In total, up to 19 million IP addresses were invaded, and tens of thousands of fraudulent COVID-related aid applications were submitted to the U.S. government through this network, which also has ties to multiple bomb threats issued across the United States in July 2022.
The action taken on Tuesday was carried out in cooperation with the Federal Bureau of Investigation, Defense Criminal Investigative Service, Commerce Department’s Office of Export Enforcement, and partners in Singapore and Thailand.
According to the Treasury Department’s announcement, Yunhe Wang is the main manager and registrant of the 911 S5 service, providing the virtual private network (VPN) used by 911 S5.
He and Jingping Liu primarily laundered their criminal proceeds through cryptocurrencies. 911 S5 users pay Yunhe Wang virtual currency, which is then exchanged into dollars through over-the-counter trading providers, and the money is then electronically transferred into Jingping Liu’s bank account.
Jingping Liu assisted Yunhe Wang in laundering money through her bank accounts, which was later used to purchase luxury homes for Yunhe Wang.
Yanni Zheng acted as the authorized agent for Yunhe Wang and his companies, representing Wang in multiple commercial transactions, making various payments, and purchasing real estate, including a luxury waterfront apartment in Thailand.
The U.S. Department of the Treasury announced the freezing of assets of these three individuals and the three companies under Executive Order 13694 “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities” (as amended).