A cybersecurity researcher responsible for stopping the spread of the WannaCry ransomware virus that locked down computers across the world and demanded bitcoin funds was arrested in the United States.
As 23-year-old Marcus Hutchins was to board a plane in Las Vegas, the FBI took him into custody. A friend posted updates on his attempts to contact Hutchins, but said authorities kept shifting his location.
He was arrested in connection with malware that targeted bank account credentials. The Telegraph reported that he is accused of creating the malware that was sold between 2014 and 2015 via the dark web, on the AlphaBay site, before it was shut down.
Hutchins initially did not want to make his identity public after his WannaCry heroics, but media entities sussed it out from the interviews he gave and the little bit of information he revealed about himself. A report from The Outline makes clear there were concerns about retaliation from the criminals responsible for WannaCry and for the other work that Hutchins does in stopping online attacks.
Comments on the Telegraph article question the FBI’s rationale for arresting a man who was seen as a hero for his expertise and work in stopping a devastating attack that crippled the U.K.’s health care system. But others said the FBI may think he was actually involved in spreading of the WannaCry ransomware. Still others suggest the authorities are trying to recruit him for national cybersecurity work, and this is just a way to get him to agree to it.
Hutchins goes by the name MalwareTechBlog on Twitter. He posts updates of his travels and his work. He did mention the name of the malware the Department of Justice (DOJ) is charging him with creating, Kronos, in a tweet, but he only said he was looking for a sample, perhaps to study. The DOJ has an eight-page indictment, charging him with creating Kronos, and charging another individual with selling it.
Another individual in the comments section of the Telegraph article said that simply because he helped end the WannaCry cyberplague does not make him immune to prosecution from committing a crime, if he was indeed involved in Kronos. He could face up to 40 years in prison.
Vice News reported that he entered the United States to attend DefCon and Black Hat, two hacker conferences, but he didn’t actually show up. He was out partying hard and spending massive amounts of cash to enjoy the city, posting updates of his fun times on Twitter.
