[Back to 911 S5 botnet dismantlement](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

# Organizations and roles

May 2024, Malware and botnets
[911 S5 botnet dismantlement](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement)

Last reviewed August 21, 2026

The public record puts 4 organizations on this action. Operational lead: FBI. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.

## Why this page names organizations only

Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.

## Organizations and roles

| Emblem | Organization | Role | What the record says |
| --- | --- | --- | --- |
| | [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation), United States | Operational lead | Led the investigation and the seizure of botnet infrastructure. |
| | [Defense Criminal Investigative Service](https://takedownindex.org/organizations/defense-criminal-investigative-service), United States | Investigating | Participated in the investigation. |
| | [Singapore Police Force](https://takedownindex.org/organizations/singapore-police-force), Singapore | Arresting | Arrested YunHe Wang in Singapore. |
| | [Office of Foreign Assets Control, United States Department of the Treasury](https://takedownindex.org/organizations/office-of-foreign-assets-control-united-states-department-of-the-treasury), United States | Other | Designated Wang, associates, and three Thai entities under sanctions in a parallel action. |

## Accountability

### Legal authority

US seizure warrants and criminal charges; Singapore, Thai, and German judicial cooperation

This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.

Last reviewed August 21, 2026