CASE DOSSIER
sentenced
U.S. v. Marcus Hutchins (Kronos Banking Malware)
Docket: 2:17-cr-00124 Court: U.S. District Court for the Eastern District of Wisconsin Opened: 2017-07-12 Sector: Banking, Consumer Finance
Key Facts
Status
SENTENCED
Legal disposition
Loss Amount
$1.5 million
Stole banking credentials and redirected bank transactions in criminal markets.
Techniques
1
Verified mappings
Defendants
1
Named in charges
- Legal Status: SENTENCED in U.S. District Court for the Eastern District of Wisconsin.
- Primary Target Sector: Banking, Consumer Finance.
- Documented Financial Loss: $1.5 million.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Export structured case data and MITRE ATT&CK Navigator layer:
Case Summary
British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.
Procedural & Incident Timeline
2017-08-02 arrest
Hutchins arrested at Las Vegas airport following the DEF CON security conference.
2019-04-19 plea
Pleads guilty to two counts of conspiracy to distribute malicious software.
2019-07-26 sentencing
Sentenced to time served and one year of supervised release with no prison time or fines, recognizing his positive contributions in halting WannaCry.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Marcus Hutchins | United Kingdom | sentenced | Pending | None | Security researcher who halted WannaCry; pleaded guilty to early malware development; sentenced to time served. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1555 | Credentials from Password Stores Credential Access | "Kronos recorded user keystrokes and used form-grabbing browser hooks to intercept unencrypted login credentials from banking websites." | Superseding Indictment ¶ 8, Page 4 | reviewed |
Cite & Embed This Case Record
Public Domain / CC0 Bluebook Legal Citation:
Cyberattack Case Library, U.S. v. Marcus Hutchins (Kronos Banking Malware), No. 2:17-cr-00124 (U.S. District Court for the Eastern District of Wisconsin 2017), https://cyberattackcaselibrary.pages.dev/cases/us-v-hutchins-kronos-malware/
Embeddable Incident Card (HTML):
<iframe src="https://cyberattackcaselibrary.pages.dev/embed/case/us-v-hutchins-kronos-malware" width="100%" height="220" style="border:none; border-radius:6px;" loading="lazy"></iframe>