On Monday, cybersecurity researcher Marcus Hutchins, better known by the nom-de-keyboard MalwareTech, pleaded not guilty to creating and distributing malware, Motherboard reports.
As April Glaser has previously explained in Slate, Hutchins rose to international prominence after he helped stop the WannaCry ransomware attack earlier this year. Accordingly, it came as a shock to many when he was arrested in August for his alleged contributions to a banking Trojan called Kronos, a piece of banking malware seemingly unrelated to WannaCry.
According to Motherboard, “[T]he prosecution said that Hutchins had admitted ‘that he was the author of the code that became the Kronos malware’ when he spoke to FBI agents” in an earlier hearing. Kronos, which first appeared in mid-2014 and reportedly sold for $7,000, primarily targeted banks in the United Kingdom and other countries, leading some, Motherboard writes, to ask why “a British researcher being indicted in the United States for a malware that apparently had no American victims.”
Even if Hutchins did contribute to the Kronos code, as prosecutors allege, it’s still not clear what, if any, evidence they have that he helped market it. The Guardian cites Jake Williams, a cyberscurity researcher who suggests it’s unlikely that Hutchins would have done so, since he refused payment for a legitimate project they worked on together around the time Kronos was active. “I have a hard time picturing him refusing money for work from me but at the same time taking money for illegal activities,” Williams tells the Guardian. More recently, as the paper also notes, Hutchins donated reward money that he received for helping shut down WannaCry.
For now, at least, Hutchins is out on bail and will, Motherboard reports, “be allowed full internet access so he can continue to work as a security researcher.” His trial is scheduled for October.
