Marcus Hutchins Recalls Stopping WannaCry and His Kronos Malware Case
· 1:06:33 · Watch on YouTube ↗
Summary
Marcus Hutchins explains how registering a domain triggered WannaCry's kill switch, and recounts his earlier role developing Kronos banking malware, his arrest and his sentence of time served.
Key points
- WannaCry spread automatically between computers, encrypted files and disrupted UK hospitals, forcing canceled procedures and patient diversions.
- Hutchins registered an unclaimed domain in WannaCry's code while investigating it as a possible command-and-control address. The registration inadvertently activated a kill switch that stopped the malware from spreading.
- The speakers attribute WannaCry to North Korea and say it used EternalBlue, an exploit they believe was developed by the NSA and leaked by Shadow Brokers.
- Hutchins said he wrote code later combined with banking malware and continued maintaining it after a seller threatened to report him to the FBI.
- He was arrested in 2017 over his involvement with Kronos, later pleaded guilty and was sentenced to time served.
Article Details
- Topics
- [05:12] WannaCry's hospital disruption and the reported origins of EternalBlue
- [07:45] WannaCry's ransom payment tracking flaw
- [09:15] Analysis of WannaCry's worm-like propagation
- [11:23] Discovery and activation of the WannaCry kill switch
- [15:43] Exposure of Hutchins's identity and the subsequent investigation
- [29:05] FBI detention and discovery of the Kronos investigation
- [35:26] Hutchins's role in developing and maintaining Kronos code
- [49:01] Criminal charges, guilty plea and sentencing
MITRE ATT&CK
Malware
KronosThe banking malware was designed to access victims' bank accounts. Hutchins said his code was combined with banking code and that he later maintained it.WannaCryThe ransomware spread between computers, encrypted files and disrupted hospitals. Registering a domain in its code activated a kill switch.