{"id":24598,"date":"2024-05-31T09:10:09","date_gmt":"2024-05-31T17:10:09","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2024\/05\/31\/news-18328\/"},"modified":"2024-05-31T09:10:09","modified_gmt":"2024-05-31T17:10:09","slug":"news-18328","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/05\/31\/news-18328\/","title":{"rendered":"How to tell if a VPN app added your Windows device to a botnet"},"content":{"rendered":"\n

On May 29, 2024, the US Department of Justice (DOJ) announced<\/a> it had dismantled what was likely the world\u2019s largest botnet ever. This botnet, called \u201c911 S5,\u201d infected systems at over 19 million IP addresses across more than 190 countries. The main sources of income for the operators, who stole a billions of dollars across a decade, came from committing pandemic and unemployment fraud, and by selling access to child exploitation materials.<\/p>\n

The botnet operator generated millions of dollars by offering cybercriminals access to these infected IP addresses. As part of this operation, a Chinese national, YunHe Wang, was arrested. Wang is reportedly<\/a> the proprietor of the popular service.<\/p>\n

Of the infected Windows devices, 613,841 IP addresses were located in the United States. The DOJ also called the botnet a residential proxy service. Residential proxy networks allow someone in control to rent out a residential IP address which then can be used as a relay for their internet communications. This allows them to hide their true location behind the residential proxy. Cybercriminals used this service to engage in cyberattacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations.<\/p>\n

To set up this botnet, Wang and his associates provided users with free, illegitimate VPN applications that were created to connect to the 911 S5 service. Unaware of the proxy backdoor, once users downloaded and installed these VPN applications, they unknowingly became part of the 911 S5 botnet.<\/p>\n

Sometimes the VPN applications were bundled<\/a> with games and other software and installed without user consent.<\/p>\n

For this reason, the FBI has published a public service announcement (PSA)<\/a> to help users find out if they have been affected by this botnet.<\/p>\n

Users can start by going over this list of malicious VPN applications associated with the 911 S5 botnet:<\/p>\n