Judge Rules No Jail Time for WannaCry ‘Killer’ Marcus Hutchins, a.k.a. MalwareTech

Yes, Hutchins will not go to prison, United States District
Judge J.P. Stadtmueller ruled today in Milwaukee County Court,
after describing his good work as “too many positives on the other
side of the ledger.”

In response to today’s sentencing Hutchins said^[1]: “Sentenced to time
served! Incredibly thankful for the understanding and leniency of
the judge, the wonderful character letter you all sent, and
everyone who helped me through the past two years, both financially
and emotionally.”

Marcus Hutchins, 25, is the same British malware analyst who
gained notoriety in cybersecurity circles for “accidentally”
helping to stop the WannaCry ransomware
outbreak in 2017 that wreaked havoc in over 150 countries and
brought down companies across all industries.
^[2]

Hutchins was arrested by the FBI in August 2017 at Las Vegas
International Airport when he was heading home to England after
attending DefCon hacking conference in Las Vegas for his alleged
role in creating and distributing Kronos between 2014 and 2015.

Kronos is a banking trojan that Hutchins created, which he
described^[3] today in court as one of
some “bad decisions” he made when he was a teenager and “deeply
regret” his conduct and the harm that was caused.

Kronos malware has been designed to steal banking credentials
and personal information of victims from their compromised
computers, which was sold for $7,000 on Russian online
forums.

UPAS Kit is a Spybot virus that unauthorizedly intercepts,
collects and exfiltrates personal information, including credit
card details, from infected computers using a form grabber and web
injects. It was advertised for prices ranged above $1,000 back in
2012.

Hutchins initially pleaded not guilty at a court hearing in August
2017 in Milwaukee and was released on $30,000
bail while awaiting trial.

However, in April this year, Hutchins pledged guilty on two
counts of creating and distributing the malware, which in total,
carries a maximum sentence of 10 years in prison, $250,000 in
fines, and up to one year of supervised release.

At that time, Hutchins said^[6]: “having grown up, I’ve
since been using the same skills that I misused several years ago
for constructive purposes. I will continue to devote my time to
keeping people safe from malware attacks.”

Now, today in court, though Hutchins accepted his role in
creating the malware, the prosecutor failed to show how much damage
Kronos actually made.

Also, citing his role in stopping WannaCry and contribution in
keeping people safe, the judge ended up giving Hutchins a lower
sentence.

The sentencing doesn’t include jail time, as the judge said
Hutchins has already served his time being arrested in Los Angeles
and can go home under one year of supervised release.

^[4][5]