911 S5
911 S5 is a residential proxy botnet/service that distributed deceptive or malicious free VPN services to victims and hijacked their IP addresses through a backdoor. It provided criminals with access to compromised IP addresses and the associated devices of both individuals and companies, enabling abuse of those systems as residential proxies. The botnet was shut down in May 2024. Content states that thousands of hijacked devices with IP addresses located in Finland were part of the botnet, and that infections occurred through malicious VPN services. It has been described as a botnet that sold or provided access to compromised residential IP space for criminal use. The content also notes that on May 29, 2024, OFAC sanctioned individuals and entities involved with the 911 S5 residential proxy botnet, and the U.S. Department of Justice announced the arrest of Chinese national Yunhe Wang, who allegedly controlled the botnet. Known high-confidence behavioral details in the provided content are limited to distribution via deceptive free VPN services, backdoor-enabled hijacking of victim IP addresses, and use of compromised devices as part of a residential proxy network.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a botnet that has faced law enforcement scrutiny since 2021.
Referenced as a botnet/proxy network that has faced law enforcement scrutiny/takedown activity since 2021.
Botnet/residential proxy service that spread deceptive free VPNs and used a backdoor to hijack victim IP addresses for downstream cybercrime.
911 S5 is a malware known for turning infected devices into proxies, allowing threat actors to route malicious traffic through victims' systems. It is often used to facilitate anonymity for cybercriminal activities and can be part of larger botnet operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.