Marcus Hutchins faces new charges of developing malware and lying to FBI

Citing legal costs rising above $100,000, Hutchins solicited donations from supporters.

The British man charged in the U.S. with developing the “Kronos” banking malware has been indicted under a new set of criminal accusations that say he developed and sold the “UPAS Kit” spybot virus.

The new indictment also charges the man, Marcus Hutchins, with lying to the FBI about knowing his code was a part of Kronos.

Hutchins, who has repeatedly denied any illegal activity and is now living in California on bail, responded quickly on Twitter, saying “these [expletive]nuggets just won’t give up.” He quickly deleted that tweet.

Hutchins’ defense team has been continuously battling federal prosecutors over evidence used in the case. While the court continues to consider the defense’s arguments about the original charges, prosecutors dropped a new indictment this week.

The charges of lying come from an exchange that Hutchins’ defense team is disputing and hoping to see dismissed. It was an Aug. 2, 2017, discussion — while Hutchins was in federal custody — in which prosecutors say Hutchins “knowingly and willfully made a materially false, fictitious, and fraudulent statement … that he did not know his computer code was part of Kronos” until 2016 when he reverse-engineered the malware.

As journalist Marcy Wheeler noted, however, prosecutor Dan Cowhig told a judge just two days later that Hutchins “admitted that he was the author of the code that became the Kronos malware and admitted that he sold that code to another.”

Hutchins’ team is trying to have the exchange dismissed because, they assert, the FBI agents who arrested him intentionally misled him about why he had been arrested and did not properly inform him of his rights as a suspect in the United States. All of that happened after Hutchins was “exhausted at the tail-end of a week-long partying binge [at the Def Con cybersecurity conference], about which the agents were on notice,” the defense lawyers told the court.

A related piece of evidence the defendant is looking to have dismissed is a phone call transcript from jail because Hutchins was “sleep-deprived and intoxicated.”

“I used to write malware, they picked me up on some old [expletive],” Hutchins told an unidentified person according to the phone transcript. “I wrote code for a guy a while back who then incorporated it into a banking malware.”

Despite being arrested last year, a trial has yet to begin. Citing legal costs rising above $100,000, Hutchins, also known by his “MalwareTech” Twitter handle, solicited donations from supporters.

https://twitter.com/MalwareTechBlog/status/1004420585869332480

https://twitter.com/MalwareTechBlog/status/1004420926941757440

UPAS Kit is described by prosecutors as a bot that “allowed for the unauthorized exfiltration of information from protected computers” that “used a form grabber and web injects to intercept and collect personal information.”

The malware was advertised to “install silently and not alert antivirus engines.” Prices ranged above $1,000 according to advertisements dating back to 2012.

You can read the new full indictment below:

https://www.documentcloud.org/documents/4496027-Superseding-Indictment.html

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure