"MalwareTech" · @MalwareTechBlog · the press's "accidental hero" ATTRIBUTED
OPERATION
malwaretech.com · malware analyst, Kryptos Logic (2017) · registrant of the WannaCry kill-switch domain FACT
HABITAT
Malware reverse-engineering blogs; DEF CON 25, once, briefly, at considerable cost
RECORD
Pleaded guilty to two counts of a ten-count superseding indictment, United States v. Hutchins, E.D. Wis.; the government moved to dismiss the rest ADJUDICATED
STATUS
TIME SERVED — plus one year of supervised release, July 2019; active researcher since FACT
DISPOSITION
The sentencing judge, per the defense's account, encouraged him to seek a pardonATTRIBUTED
I was just sort of doing my job, and I don’t really think that I’m a hero at all.
Marcus Hutchins, days after a single domain registration halted the global WannaCry outbreak — and months before the FBI arrested him at the Las Vegas airport over a banking trojan he wrote as a teenager. The Guardian, May 2017.
The specimen, observed May 2017 halting a global ransomware outbreak with a domain registration, and observed August 2017 in handcuffs at the Las Vegas airport. Same animal. The field required a federal judge to reconcile the two sightings.
Approach this drawer differently. The files around it hold fabricated credentials and vanished clients; this one holds something the genre almost never produces — a subject who did the extraordinary good thing, and had done the documented bad thing, and admitted the bad thing in writing, and was told by the sentencing judge, in effect, that the ledger favored him. There is no fraud here. There is a whiplash, and a community that argued about it at volume for two years.
A redemption arc is the hardest footage to trust, which is exactly why it must be sourced. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone.
the drama timeline
ACT I — THE OFFENSES, COMMITTED YOUNG (2012–2015)
Every specimen in this drawer has an Act I it would rather the camera skip. This one differs in a single respect that will decide the whole film: when the time came, he signed his name under it.
JUL 2012–SEP 2015
Kronos and the UPAS Kit
Per his own later plea agreement, Hutchins helps create and sell the UPAS Kit and the Kronos banking trojan — malware built to steal online banking credentials — between July 2012 and September 2015. He is in his late teens when the window opens. By the time it closes he has quit the trade and turned to defense work; the courts will hear about both halves.
The rarest event a camera can hope for: the moment a single unremarkable action, taken quickly by the one observer positioned to take it, changes the weather on every continent at once.
MAY 12, 2017
WannaCry meets a domain registration
The WannaCry ransomware worm tears through networks worldwide — more than 230,000 machines across 150 countries by contemporary counts, with the UK's National Health Service among the casualties. Hutchins, then 22 and working as a malware analyst for Kryptos Logic, notices the worm queries an unregistered domain, registers it, and — the domain functioning as a kill switch — halts the outbreak. His own write-up says the full effect was understood only after the fact; the press compresses this to "accidental hero." On camera, in the Kaspersky documentary below, he rejects the label outright: "I sort of just registered this domain for tracking and I didn't intend for it to… blow up and me to be all over the media. I was just sort of doing my job, and I don't really think that I'm a hero at all."
Hutchins tells the kill-switch story on camera in Kaspersky's hacker:HUNTER documentary (Tomorrow Unlocked, 2019) — the exclusive first-hand interview at the center of the film.
The Guardian's headline canonizes the phrase: "'Accidental hero' finds kill switch to stop spread of ransomware cyber-attack." Interviews, profiles, industry celebration. For one season he is the most famous defender on the internet.
Savor the season. In this genre, elevation of this height and speed is almost always scaffolding for the next act.
Three months. The interval between the front page and the airport is three months.
AUG 3, 2017
Arrested at the airport, leaving DEF CON 25
As Hutchins prepares to fly home to England, the FBI arrests him at the Las Vegas airport. The charges have nothing to do with WannaCry: a sealed six-count federal indictment out of the Eastern District of Wisconsin, over Kronos. The researcher the industry spent the summer celebrating spends the night in federal custody, three months after saving the NHS's week.
Law professor Orin Kerr publishes a same-day dissection of the indictment, questioning whether creating and selling malware — without deploying it — fits the statutes charged, including whether software is a "device" under the wiretap-device law at all. The prosecution's theory, per Kerr, "will face significant legal challenges." The community splits loudly: donors fund the defense; others insist the past is the past only after it is answered for.
The government returns a ten-count superseding indictment, adding UPAS Kit conduct and a count of making false statements to the FBI. Eight of the ten will never be proven; see the plea.
Watch the closing scene carefully, because nothing else in this archive ends this way.
APR 19, 2019
He signs it
Hutchins pleads guilty to Counts One and Two — conspiracy, and distributing a device for intercepting electronic communications — with a combined exposure of up to roughly a decade in prison. His public statement, in full acceptance: "I regret these actions and accept full responsibility for my mistakes. Having grown up, I've since been using the same skills that I misused several years ago for constructive purposes. I will continue to devote my time to keeping people safe from malware attacks." The government agrees to move to dismiss the remaining eight counts.
Judge J.P. Stadtmueller sentences Hutchins to time served and one year of supervised release. From the bench, on the man in front of him: "It's going to take the people…with your skills to come up with solutions because that's the only way we're going to eliminate this entire subject of the woefully inadequate security protocols." The judge credits the youthful offender with turning a corner before the government ever knocked; per defense attorney Brian Klein, he goes further — "the judge encouraged Marcus to seek a pardon." The same judge notes the conviction will likely bar him from re-entering the United States: the sentence is lenient; the collateral is not.
Mark this frame. A federal sentencing judge, the least sentimental observer in any ecosystem, looked at both sightings of the animal and priced them together. The archive has no other footage like it.
In May 2020 Wired publishes Andy Greenberg's book-length account, "The Confessions of Marcus Hutchins, the Hacker Who Saved the Internet" — the whiplash, told end to end. Hutchins keeps publishing malware research at malwaretech.com and remains one of the most-followed analysts in the field. The debt the only relevant court ever billed him is marked paid. The archive keeps the tape running.
The adjudicated conduct: by his own signed plea, Hutchins helped create and sell UPAS Kit and the Kronos banking trojan between July 2012 and September 2015 — crimeware, built for credential theft, sold to whoever paid [1][7].
The prosecution's framing (theirs, not ours): its sentencing filing compared him to a reformed bank robber — the later good works are real, and the robberies still happened, per CyberScoop's courtroom report [9].
The uncomfortable symmetry: the skills that stopped WannaCry and the skills that built Kronos are the same skills. Nobody on either side of the courtroom disputed it.
The hero act is not alleged; it is documented. He registered the WannaCry kill-switch domain and halted a global outbreak that was eating the NHS in real time — his own write-up, the world's front pages, and the sentencing court all treat it as fact [4][12].
The reform predates the arrest. The offense window closed in 2015; the FBI knocked in 2017. He had already quit and switched sides before anyone made him — the sentencing judge credited exactly that, called it the work of a youthful offender who had turned a corner, gave him time served, and, per his attorney, encouraged a pardon [8][9].
Scope of the record: he pleaded to two counts; eight — including the false-statement charge — were never proven, and respected legal scholars publicly doubted the government's theory from day one [3][6]. He accepted full responsibility, in public, in his own name [7]. No conduct after 2015 has ever been alleged.
YOU DECIDE
Scoped to the claims, never the man. "He wrote and sold banking malware, young" — adjudicated true, by his own signature. "He stopped WannaCry" — documented true, by everyone including the court that sentenced him. Both claims survived; the only argument left is which one weighs more, and the one observer legally required to weigh them answered: time served, and see about a pardon.
Weigh the costly signals: he quit the trade two years before anyone made him, signed a guilty plea instead of gambling on a shaky prosecution theory, and took responsibility in his own name. The government, for its part, filed ten counts and proved two — both by his consent.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY RECORD
Plea Agreement, United States v. Hutchins, No. 17-CR-124, E.D. Wis.ADJUDICATED — the counts, the conduct, the dismissal terms, over his signature.
regmedia.co.uk/2019/04/19/plea.pdf
Orin Kerr, Volokh Conspiracy — "The Kronos indictment: Is it a crime to create and sell malware?" (Aug 2017)ATTRIBUTED — the legal academy's doubts about the government's theory.
reason.com/volokh/2017/08/03/the-kronos-indictment-is-it-a/
Wikipedia — Marcus HutchinsFACT — sourced biography: the kill-switch mechanics, Kryptos Logic, the outbreak scale, the case chronology.
en.wikipedia.org/wiki/Marcus_Hutchins
X — @MalwareTechBlogSELF-PUBLISHED — the subject's account, active, in his own words. Account-level link only; no fabricated permalinks.
x.com/MalwareTechBlog
The standard. Everything above is sourced to the court's own record, the government's own press release, named press reporting, and the subject's own published pages. Facts are stated as facts; the guilty plea is stated as what it is — his, signed, scoped to 2012–2015 — and the eight unproven counts are stated as unproven. The defense is presented at full strength, because for this subject the record itself is the defense: the hero act is documented, the reform preceded the arrest, and the sentencing judge said so on the record. No motive is asserted, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.