Hacker who helped stop global cyberattack arrested

LAS VEGAS (AP) — Marcus Hutchins, a young British researcher credited with derailing a global cyberattack in May, was arrested for allegedly creating and distributing malicious software designed to collect bank-account passwords, U.S. authorities said Thursday.

News of Hutchins' detention came as a shock to the cybersecurity community. Many had rallied behind the researcher whose quick thinking helped control the spread of the WannaCry ransomware attack that crippled thousands of computers.

Hutchins was detained in Las Vegas on his way back to Britain from an annual gathering of hackers and information security gurus. A grand jury indictment charged Hutchins with creating and distributing malware known as the Kronos banking Trojan.

Such malware infects web browsers, then captures usernames and passwords when an unsuspecting user visits a bank or other trusted location, enabling cybertheft.

The indictment, filed in a Wisconsin federal court last month, alleges that Hutchins and another defendant — whose name was redacted — conspired between July 2014 and July 2015 to advertise the availability of the Kronos malware on internet forums, sell the malware and profit from it. The indictment also accuses Hutchins of creating the malware.

Authorities said the malware was first made available in early 2014, and "marketed and distributed through AlphaBay, a hidden service on the Tor network." The U.S. Department of Justice announced in July that the AlphaBay "darknet" marketplace was shut down after an international law enforcement effort.

Hutchins' arraignment was postponed Thursday in U.S. District Court in Las Vegas by a magistrate judge who gave him until Friday afternoon to determine if he wants to hire his own lawyer.

Hutchins was in Las Vegas for Def Con, an annual cybersecurity conference that ended Sunday. On Wednesday, Hutchins made-comments on Twitter that suggested he was at an airport getting ready to board a plane for a flight home. He never left Nevada.

Jake Williams, a respected cybersecurity researcher, said he found it difficult to believe Hutchins is guilty. The two men have worked on various projects, including training material for higher education for which the Briton declined payment.

"He's a stand-up guy," Williams said in a text chat. "I can't reconcile the charges with what I know about him."

A Justice Department spokesman confirmed the 22-year-old Hutchins was arrested Wednesday in Las Vegas. Officer Rodrigo Pena, a police spokesman in Henderson, near Las Vegas, said Hutchins spent the night in federal custody in the city lockup.