What is Kronos?

What is Kronos?

Kronos is a form of malicious computer software, known as a banking trojan, that is designed to steal people’s financial details when they sign in to online services such as internet banking.

It emerged in 2014, when security researchers first spotted that it was being advertised on Russian forums for $7,000 (£5,300).

The name derives from the mythical Greek titan, the father of Zeus.

Who is Marcus Hutchins?

Hutchins is a security expert who lives with his parents in Devon, and is a British national. He was lauded in May when he discovered a “kill switch” that halted the spread of the WannaCry attack that crippled computer systems in parts of the NHS.

Hutchins was attending Las Vegas for the Black Hat and Def Con conferences that happen there, and appears to have been arrested shortly before his plane was due to fly home.

Marcus Hutchins at his workstation
Marcus Hutchins at his workstation CREDIT: AP
What is he accused of?

The indictment alleges two people, Hutchins and an unnamed individual, between them created, advertised and sold the Kronos malware.

The other individual, whose name is redacted from the indictment, is named first, and is accused of putting Kronos up for sale on the online black market AlphaBay, which was recently shut down.

Hutchins is alleged to have created the Kronos malware in the first place, and updated it.

Why is he linked with the Kronos malware?

Neither the indictment, nor the Department of Justice announcement, say how they connected him to the malware. Forensic computer investigations are lengthy and often involve tracking online aliases and looking for patterns that hackers have tried to hide.

Hutchins tweeted in July 2014 about Kronos, asking if anyone had a sample of it.

But as many have pointed out, this shows little. Hutchins, who goes by the Twitter handle MalwareTech, is known for his security work tracking malware such as Kronos, and the tweet was 14 days after mentions of it first appeared.

What could he face?

Hutchins and the unnamed individual each face six charges - one of computer fraud, three of creating and distributing wiretapping technology, one of wiretapping or aiding wiretapping itself, and one of accessing a computer without permission.

Tor Ekeland, a US lawyer who specialises in defending alleged hackers, said the charges could add up to a maximum of 40 years in prison, although a lot has to happen first. A sentence of between five and 10 years could accompany a guilty verdict.

What happens now?

Hutchins will appear in a court in Nevada on Friday when he could enter a guilty or not guilty plea, although this might happen at a later date. He may be sent to Wisconsin to face the charges, since it is there that they stem from.

If granted a speedy trial, proceedings could begin in 70 days. If he waives this right, the case may not be heard for over a year. Lawyers say Hutchins is unlikely to be granted bail, since as a British citizen he could be deemed a flight risk