04 August, 2017
"Marcus Hutchins. a citizen and resident of the United Kingdom, was arrested in the United States on 2 August, 2017, in Las Vegas, Nevada, after a grand jury in the Eastern District of Wisconsin returned a six-count indictment against Hutchins for his role in creating and distributing the Kronos banking Trojan", it said.
The WannaCry attack infected computers in more than 150 companies, crippling hospitals and telecoms firms, before Hutchins stumbled across a kill switch while investigating it.
Marcus Hutchins, a British-based malware researcher who gained attention for detecting a "kill switch" that effectively disabled the WannaCry worm in May, was detained by Federal Bureau of Investigation officials in Nevada days after tens of thousands of hackers descended on Las Vegas for the annual Black Hat and Def Con security conferences, a US Marshals Service spokeswoman said.
A security researcher who in May stopped an outbreak of the WannaCry ransomware has been arrested and detained after attending the Def Con conference in Las Vegas.
According to an indictment filed in federal court in Milwaukee on Thursday, Mr. Hutchins and an unidentified accomplice created and sold malware meant to steal login information and other financial data from online banking sites. An indictment from the Department of Justice, dated July 11, alleges that the 23-year-old created the Kronos malware. The researcher goes by the handle of MalwareTech. Kronos is a financial malware trojan, created to steal banking credentials from victims. The Department of Justice announced on July 20, 2017, AlphaBay was shuttered through an worldwide law enforcement effort.
"I'm working on getting a lawyer for @MalwareTechBlog as he has no legal representation and no visitors", Mabbitt continued to say.
After stopping WannaCry, Hutchins wrote online that the ransomware had been a series of "crazy events". Hutchins was able to register the server and then prevent the WannaCry malware from spreading any further.
The malware, it turned out, contained computer code that pinged an unregistered Web address, and if it didn't get back a message saying the address didn't exist, it turned itself off. Hutchins' act stopped much of its spread.
No one has claimed responsibility for the May attack but experts have connected it to Lazarus, a group also linked to the 2014 Sony Pictures hack.
