US sanctions operators of “free VPN” that routed crime traffic through user PCs

The US Treasury Department has sanctioned three Chinese nationals for their involvement in a VPN-powered botnet with more than 19 million residential IP addresses they rented out to cybercriminals to obfuscate their illegal activities, including COVID-19 aid scams and bomb threats.

The criminal enterprise, the Treasury Department said Tuesday, was a residential proxy service known as 911 S5. Such services provide a bank of IP addresses belonging to everyday home users for customers to route Internet connections through. When accessing a website or other Internet service, the connection appears to originate with the home user.

In 2022, researchers at the University of Sherbrooke profiled 911[.]re, a service that appears to be an earlier version of 911 S5. At the time, its infrastructure comprised 120,000 residential IP addresses. This pool was created using one of two free VPNs—MaskVPN and DewVPN—marketed to end users. Besides acting as a legitimate VPN, the software also operated as a botnet that covertly turned users’ devices into a proxy server. The complex structure was designed with the intent of making the botnet hard to reverse engineer.

An illustration showing how the DewVPN and MaskVPN caused devices to connect to a command-and-control server located in the back end of an entity called Krypt Technologies.

Credit: University of Sherbrooke

MaskVPN and DewVPN connected devices to the type of server legitimate VPNs use to obfuscate the originating IP address and route traffic through an encrypted tunnel. At the same time, hidden functionality established a permanent TCP socket to a botnet command-and-control server. University of Sherbrooke researchers wrote:

This TCP connection is made to the C2 servers of the 911.re backend infrastructure and renders the node available for connections through the 911.re interface. A heartbeat process is in place to ensure the node is listed as available. At no time, there is direct connection between the infected node and the 911.re paid subscriber even when the node is selected, and traffic passes through. All the network traffic is always routed between the C2 servers that are USA based, reducing the risk of anomaly detection by IDS or IPS systems. Mask VPN and Dew VPN are using a custom implementation of the open-source OpenVPN.

Illustration showing how traffic of 911 users was routed through residential IP addresses.

Credit: University of Sherbrooke

The research led to an investigation by KrebsOnSecurity that uncovered Yunhe Wang of Beijing as one of the individuals who registered domains used by the 911[.]re infrastructure.

Wang was one of three people sanctioned on Tuesday. Treasury officials said that Wang was the registered subscriber of services used both by 911 S5 and the MaskVPN and DewVPN operations, an indication they were relying on some of the same resources reporter Brian Krebs did. They also named Jingping Liu as a co-conspirator for allegedly helping Wang launder virtual currency and other proceeds generated from the 911 S5 enterprise. The officials further named Yanni Zheng for allegedly acting under the power of attorney for Wang and participating in business transactions and making purchases and payments on Wang’s behalf, including for a luxury beachfront condominium in Thailand.