Briton Who Stopped WannaCry Arrested

Marcus Hutchins, (Twitter ID @MalwareTech) the British security researcher who was credited with stopping the WannaCry outbreak in its tracks by discovering a hidden “kill switch” for the malware, has been arrested by the FBI over his alleged involvement in another malicious software targeting bank accounts.

According to an indictment released by the US Department of Justice on Thursday 3rd August, Hutchins is accused of having helped to create, spread and maintain the banking Trojan Kronos between 2014 and 2015.

The Kronos malware was spread through emails with malicious attachments such as compromised Microsoft word documents, and hijacked credentials such as Internet banking passwords to let its user steal money with ease.

Hutchins, who is indicted with another unnamed co-defendant, stands accused of six counts of hacking-related crimes as a result of his alleged involvement with Kronos. “Defendant Marcus Hutchins created the Kronos malware,” the indictment, filed on behalf of the eastern district court of Wisconsin, alleges. 

He was arraigned in Las Vegas and made no statement in court beyond mumbling one-word answers in response to a few basic questions from the judge.

A public defender noted that Hutchins has no criminal history and has cooperated with federal authorities in the past. The court-appointed attorney said Hutchins needed more time to hire a private attorney. 
His mother, Janet Hutchins, told the Press Association it was “hugely unlikely” that her son was involved because he has spent “enormous amounts of time” combating such attacks. She said she was “outraged” by the charges and has been “frantically calling America” trying to reach her son.

At the courthouse, a friend of Hutchins who declined to give his name, said he was shocked to hear about the arrest. 
“There’s probably a million difference scenarios that could have played out to where he’s not guilty,” he said. “I’m definitely worried about him.”

Special agent in charge Justin Tolomeo said: “Cyber-criminals cost our economy billions in loses each year. The FBI will continue to work with our partners, both domestic and international, to bring offenders to justice.”
Hutchins’ co-defendant advertised the malware for sale on AlphaBay, a darknet marketplace, the indictment alleges, and sold it two months later. The encrypted website operated like an extralegal eBay for drugs and malware, with independent sellers offering their products in exchange for payment in a number of crypto-currencies such as bitcoin. It was not clear from the indictment if the malware was actually sold through AlphaBay.

The marketplace was shut down on 20 July, following a seizure of its servers by US and European police including the FBI and the Dutch national police. FBI acting director Andrew McCabe said AlphaBay was 10 times as large as the notorious Silk Road marketplace at its peak.

When the site was taken down, its servers were seized, giving authorities a window into activity on the site. The operation included the arrest on 5 July of suspected AlphaBay founder Alexandre Cazes, a Canadian citizen detained on behalf of the US in Thailand. Cazes, 25, died a week later while in Thai custody.

New Kronos infections continued as late as 2016, when the malware was repurposed into a form used to attack small retailers, infecting point-of-sale systems and harvesting customers’ credit card information.
“A lot of us thought of Kronos as crime-ware-as-a-service,” Kalember said, since a Kronos buyer would also be getting “free updates and support” and that “implied there’s a large group behind it”.

He also warned that the actions of a researcher examining the malware can look very similar to those of a criminal in charge of it. “This could very easily be the FBI mistaking legitimate research activity with being in control of Kronos infrastructure. Lots of researchers like to log in to crime-ware tools and interfaces and play around.”
On top of that, for a researcher looking into the world of banking hacks, “sometimes you have to at least pretend to be selling something interesting to get people to trust you”, he said. “It’s not an uncommon thing for researchers to do and I don’t know if the FBI could tell the difference.”
On June 13, a video demonstrating the Kronos malware was posted to YouTube, allegedly by Hutchins’ co-defendant (the video was taken down shortly after Hutchins’ arrest). That same day, Hutchins tweeted asking for a sample of the malware to analyse.

Hutchins, better known online by his handle MalwareTech, had been in Las Vegas for the annual Def Con hacking conference, the largest of its kind in the world. He was at the airport preparing to leave the country when he was arrested, after more than a week in the city without incident.

The security researcher became an accidental hero in May when he registered a website, which he had found deep in the code of the ransomware outbreak that was wreaking havoc around the world, including disrupting operations at more than a third of NHS trusts and bodies. The site, it turned out, acted as a kill switch for the malware, which stopped infecting new computers if it saw that the URL had been registered.

When WannaCry first appeared, in early May, it spread rapidly, infecting hundreds of thousands of computers worldwide in less than a day, encrypting their hard drives and asking for a ransom of $300 in bitcoin to receive the decryption key. It moved particularly quickly through corporate networks thanks to its reuse of security exploit, called EternalBlue, first discovered by the NSA before being stolen and leaked by an allegedly Russian-linked hacking group called The Shadow Brokers.
Both US and UK intelligence agencies later linked the malware outbreak to North Korean state actors, who have become bolder in recent years at using cyberattacks to raise revenue for the sanction-laden state. 

Hutchins was recently given a special recognition award at cybersecurity celebration SC Awards Europe for halting the WannaCry malware. The malware ended up affecting more than 1m computers, but without Hutchins’ apparent intervention, experts estimate that it could have infected 10-15m.

Hutchins’ employer, cybersecurity firm Kryptos Logic, had been working closely with the US authorities to help them investigate the WannaCry malware. Hutchins handed over information on the kill switch to the FBI the day after he discovered it, and the chief executive of the firm, Salim Neino, testified in from of the US House of Representatives Committee on Science, Space & Technology the following month.
“The largest success, though incomplete, was the ability for the FBI and NCSC of the United Kingdom to aggregate and disseminate the information Kryptos Logic provided so that affected organisations could respond,” Neino told the committee.  
Hours after Hutchins was arrested by the FBI, more than $130,000 (£100,000) of the bitcoin ransom taken by the creators of WannaCry was moved within the bitcoin network for the first time since the outbreak. There is nothing to suggest the withdrawal, which appears to have moved the coins into a “mixer”, a digital money-laundering system, is connected to the arrest of Hutchins.

Guardian

You Might Also Read:

WannaCry Drives Cyber Insurance:

WannaCry Returns To Attack Honda:

 

« S. Korea Spy Agency Attempted To Rig Election
The Rise Of The Introvert: Is There An IT Personality? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

A10 Networks

A10 Networks

A10 Networks is a leader in application networking, helping organizations of all sizes to accelerate, optimize and secure their applications.

edgescan

edgescan

edgescan is a cloud-based continuous vulnerability management and penetration testing solution.

ASU Online - Information Technology Program

ASU Online - Information Technology Program

The Information Technology program at ASU Online provides you with the expertise to design, select, implement and administer computer-based information solutions.

Siepel

Siepel

Siepel manufactures high quality shielded rooms and anechoic chambers dedicated to TEMPEST, NEMP & HIRF.

National Agency for Information & Communication Technologies (ANTIC) - Cameroon

National Agency for Information & Communication Technologies (ANTIC) - Cameroon

ANTIC is responsible for regulating the activities of electronic security and regulation of the Internet in Cameroon.

OneWelcome

OneWelcome

Onegini and iWelcome have merged to become OneWelcome, the largest European Identity Access Management Saas Vendor.

AKS IT Services

AKS IT Services

AKS IT Services (an ISO 9001:2015 and ISO 27001:2013 certified company) is a leading IT Security Services and Solutions provider.

Information Technology Industry Development Agency (ITIDA)

Information Technology Industry Development Agency (ITIDA)

ITIDA has two broad goals: building the capacities of Egypt’s local information and communications technology (ICT) industry and attracting foreign direct investments to boost the ICT sector.

iosiro

iosiro

iosiro was created to guide companies through securely using blockchain technologies. We help teams launch and manage ICOs, deploy secure dApps, and integrate private networks into business practices.

Tech Nation

Tech Nation

Tech Nation is the UK’s first national scaleup programme for the cyber security sector, aimed at ambitious tech companies ready for growth, at home and abroad.

drie

drie

drie is an end-to-end cloud services company based in Bahrain, Dubai and London. We enable businesses to adopt, scale on and build for cloud.

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV) is a 6000+ members angel investing firm which supports new-age entrepreneurs by connecting them with a diverse group of investors.

Upstack

Upstack

UPSTACK - One partner, end-to-end expertise, helping develop the solutions you need – when you need them.

Dion Training Solutions

Dion Training Solutions

Dion Training Solutions offer comprehensive training in areas such as project management, cybersecurity, agile methodologies, and IT service management.

FTI Consulting

FTI Consulting

FTI Consulting is a global business advisory firm dedicated to helping organizations manage change, mitigate risk and resolve disputes.

Aberrant

Aberrant

A radically new approach to managing information security. Aberrant is the single pane of glass through which a security program can be viewed.