US govt sanctions cybercrime gang behind massive 911 S5 botnet

OFAC sanctioned three individuals and three Thailand-based companies tied to the 911 S5 residential proxy botnet after investigations showed the service infected devices worldwide (reported ~19 million IP addresses), enabling large-scale CARES Act fraud (resulting in billions in losses), bomb threats, and general cyber-enabled fraud; the infrastructure was later seen resurfacing as "CloudRouter." The report highlights how compromised residential devices were used as proxies to obscure attacker attribution and facilitate widespread criminal activity.