LAS VEGAS – Marcus Hutchins, a young British researcher credited with derailing a global cyberattack in May, was arrested for allegedly creating and distributing malicious software designed to collect bank-account passwords, U.S. authorities said Thursday.
Hutchins was detained in Las Vegas on his way back to Britain from an annual gathering of hackers and IT security gurus. A grand jury indictment charged Hutchins with creating and distributing malware known as the Kronos banking Trojan.
Such malware infects web browsers, then captures usernames and passwords when an unsuspecting user visits a bank or other trusted location.
News of Hutchins’ detention came as a shock to the cybersecurity community. Many had rallied behind the researcher whose quick thinking helped control the spread of the WannaCry attack that crippled thousands of computers last May.
The indictment, filed in a Wisconsin court last month, alleges that Hutchins and another defendant — whose name is redacted — conspired from July 2014 and July 2015 to advertise the availability of the Kronos malware on internet forums, sell the malware and make money off it. The indictment also accuses Hutchins of creating the malware.
Got the indictment. @MalwareTechBlog arrested for his role in creating + distributing Kronos trojan https://t.co/EfZsCoGuXK
— Selena Larson (@selenalarson) August 3, 2017
Authorities said the malware was first made available in early 2014, and “marketed and distributed through AlphaBay, a hidden service on the Tor network.” The U.S. Department of Justice announced in July that the AlphaBay “darknet” marketplace was shut down after an international law enforcement effort.
A court hearing was scheduled for Hutchins on Thursday afternoon in Las Vegas. It was not immediately clear if he has a lawyer.
The Electronic Frontier Foundation, a San Francisco-based digital rights group, said it was “deeply concerned” about Hutchins’ arrest and is attempting to reach him.
Hutchins had recently attended Def Con, an annual cybersecurity conference in Las Vegas that ended Sunday. On Wednesday, Hutchins made some routinecomments on Twitter that suggested he was at an airport getting ready to board a plane for a flight home. But he never left Nevada.
Andrew Mabbitt, a British digital security specialist who had been staying in Las Vegas with Hutchins, said he and his friends grew worried when they got “radio silence” from Hutchins for hours. The worries deepened when Hutchins’ mother called to tell him the young researcher hadn’t made his flight home.
Mabbitt said he eventually found Hutchins’ name on one of the detention center’s websites.
KEN RITTER
MATT O’BRIEN
