Marcus Hutchins Pleads Guilty to Creating and Distributing the Kronos Banking Trojan and UPAS Kit Malware

Matthew D. Krueger, the United States Attorney for the Eastern District of Wisconsin, announced that on May 2, 2019, Marcus Hutchins, aka “MalwareTech,” pleaded guilty to two counts relating to his creation and distribution of the Kronos banking Trojan and UPAS Kit malware. This includes one count of conspiracy to commit computer fraud in violation of Title 18, United States Code, Section 371, and one count of advertising a device used to intercept electronic communications, in violation of Title 18, United States Code, 2512(1)(c)(i).

According to admissions made in connection with his plea, Hutchins, age 24, developed UPAS Kit and Kronos and then worked with an accomplice to sell the malware programs for profit. Both UPAS Kit and Kronos were designed to be deployed secretly on victim computers, and then to intercept communications and transmit personal information, including usernames, passwords, email addresses, and financial data to the person controlling malware program. The malware was specially tailored to target victims’ banking information. Since 2014, Kronos has been used to infect numerous computers around the world and steal banking information.

Hutchins and his accomplice, “Vinny,” advertised Kronos and UPAS on various websites, including the AlphaBay market and Darkode forum. The advertisements highlighted the ability of the malware to steal information and avoid antivirus programs. Hutchins updated the malware code as needed, and Vinny and Hutchins shared profits from the sales.

“Vigorous prosecution of cybercrimes is vitally important because the stakes are so high:  The proliferation of malware poses serious threats to our nation’s infrastructure, our businesses, and our personal information,” said U.S. Attorney Krueger. “We commend the FBI’s Cyber Division for its excellent work in investigating this sophisticated and dangerous crime.” 

Hutchins faces a maximum term of 5 years imprisonment and up to one year of supervised release on each count. His sentencing hearing is set for July 26, 2019, at 11:30 a.m before U.S. District Judge J.P. Stadtmueller.

This case was investigated by the Federal Bureau of Investigation Cyber Crime Task in Milwaukee. The case is being prosecuted by Assistant United States Attorneys Benjamin Proctor and Benjamin Taibleson.

#    #    #