Arrest of WannaCry Hero Rocks the Infosec Community

Marcus Hutchins, a white hat infosec researcher also known as MalwareTech, achieved hero status earlier this year when he played a major role in stopping the WannaCry ransomware. But before boarding his return flight to the UK after attending the DEF CON conference in Nevada, he was taken into custody by the FBI, who have accused him of creating and selling the Kronos banking malware for $2,000 worth of Bitcoin – and now faces the prospect of up to 40 years in prison.

He was initially denied access to a laywer for 48 hours, but a bail of $30,000 has now been set – however, the bail office was closed for the weekend by the time court proceeding had finished, so he will spend the weekend behind bars. Marcus has pleased not guilty, and when bailed will be monitored at all times and not permitted to use any device with an internet connection.

The allegations by the FBI against Marcus have turned the infosec world on its head. Marcus is a prominent voice in UK infosec, has worked with the UK government’s National Cyber Security Centre, and works from the UK, earning a 6-figure salary from an LA-based security firm. Many in the Twitter-sphere who knew him have been tweeting out their disbelief and support.

One note: Big difference between MalwareTech having a blackhat past, and him being guilty&equally culpable in the charges in the indictment.

— SwiftOnSecurity (@SwiftOnSecurity) August 5, 2017

MalwareTech is easily the most talented guy I've ever met, he's a great person and an integral part of the UK cyber security effort.

— Kevin Beaumont (@GossiTheDog) August 3, 2017

I hope he was framed and innocence proven in that case. This is utter BS and his personality doesn't reflect this type of dark behavior...

— 呃伙计 (@zuphzuph) August 3, 2017

Regardless of Marcus’ guilt or innocence, it also raises an interesting question: is creating and selling malware illegal, if you don’t actually use it or profit from the proceeds of its use?

Additionally, there are companies that straight-up sell world-class malware, which is needed by penetration testers to simulate attacks.

— SwiftOnSecurity (@SwiftOnSecurity) August 4, 2017

Marcus is likely to incur significant legal fees, and member of the infosec community have set up a Bitcoin donation address for him, with donations by card being accepted from Monday.

Official bitcoin donation address for @MalwareTechBlog's legal fund - 1AoiAwTQbUvHNQQ55gCXAw3SLqRVs6ZtW1

— Andrew Mabbitt (@MabbsSec) August 5, 2017