WannaCry attack ‘hero’ arrested over banking malware

Marcus Hutchins helped foil the ransomware virus that hit more than 150 countries

A British computer expert who helped shut down a worldwide cyber attack has been arrested by the FBI in the US, on charges relating to the Kronos banking malware, according to a court filing unsealed on Thursday.

Marcus Hutchins, also known as MalwareTech, helped foil the WannaCry “ransomware” virus that hit more than 300,000 computers in 150 countries earlier this year.

He was arrested at Las Vegas’s McCarran International Airport on Wednesday afternoon after he left a hacker conference, according to a friend who spoke on the condition of anonymity.

The friend, who also works in the cyber-security industry, was attending the Def Con event in the Nevada city with Hutchins.

READ MORE

The friend said: “He was detained at McCarran airport yesterday. He checked into his flight and I think he was sitting in the Virgin upper-class lounge.

“He was escorted out of the airport and never made his flight.”

Indictment

According to an indictment released by the US department of justice on Thursday, Hutchins is accused of having helped to create, spread and maintain the banking malware Kronos between 2014 and 2015.

The Kronos malware was spread through emails with malicious attachments such as compromised Microsoft Word documents, and hijacked credentials like internet banking passwords to let its user steal money with ease.

Hutchins, who is indicted with another unnamed co-defendant, stands accused of six counts of hacking-related crimes as a result of his alleged involvement with Kronos.

"Defendant Marcus Hutchins created the Kronos malware," the indictment, filed on behalf of the eastern district court of Wisconsin, alleges.

The UK's National Crime Agency confirmed Hutchins had been detained, saying: "We are aware a UK national has been arrested, but it is a matter for the authorities in the US."

Hutchins was 22 when he was hailed a hero last May after he found a “kill-switch” that slowed the effects of the ransomware virus.

Guardian services and PA