$99M laundered. 19M+ IP addresses compromised. Sayari traced the botnet operator’s hidden empire.

In 2024, Wang Yunhe was indicted by the U.S. Department of Justice for operating the 911 S5 botnet – the largest residential proxy botnet ever dismantled. The botnet compromised 19M+ IP addresses across 200 countries, enabling cybercrime, fraud, and sanctions evasion on a massive scale. Wang Yunhe allegedly laundered $99M+ in proceeds through a global network of corporate entities and real estate purchases. The DOJ case was significant, but left questions about the full scope of the corporate infrastructure used to move and hide the funds.

Sayari corporate records reveal a network of holding companies, shell entities, and real estate vehicles in Singapore, Thailand, and other jurisdictions – many not disclosed in the DOJ indictment. These entities were used to purchase luxury properties, move funds between jurisdictions, and create layers of corporate distance between the botnet operation and the laundered proceeds. The corporate structures follow patterns commonly associated with professional money laundering – nominee directors, layered holdings, and jurisdictional arbitrage.

Analysis of corporate ownership chains and trade records traces the flow of funds from botnet revenue to real estate acquisitions and luxury assets. The investigation reveals how Wang Yunhe used corporate entities across multiple jurisdictions to convert cybercrime proceeds into hard assets – a laundering methodology designed to survive asset seizure by distributing holdings across corporate structures that appear unrelated. Sayari Graph connects these entities through shared ownership, common directors, and financial relationships invisible to single-jurisdiction analysis.

Cybercrime and financial crime are converging. The Wang Yunhe case demonstrates how cyber operations generate proceeds that are laundered through traditional corporate infrastructure – the same companies, jurisdictions, and methods used in sanctions evasion and organized crime. For financial institutions, this means screening customer portfolios against indicators of cybercrime-linked money laundering. For law enforcement, it means using corporate data to identify assets and entities beyond the initial indictment.