158: MalwareTech

MalwareTech was an anonymous security researcher, until he accidentally stopped WannaCry, one of the largest ransomware attacks in history. That single act of heroism shattered his anonymity and pulled him into a world he never expected. https://malwaretech.com https://malwaretech.com/ SponsorsSupport for the show comes from Black Hills Information Security https://www.blackhillsinfosec.com/darknet. Black Hills has a variety of penetration assessment and security auditing services they provide customers to help keep improve the security of a company. If you need a penetration test check out www.blackhillsinfosec.com/darknet https://www.blackhillsinfosec.com/darknet. Support for this show comes from Arctic Wolf https://arcticwolf.com/darknet. Arctic Wolf is the industry leader in security operations solutions, delivering 24x7 monitoring, assessment, and response through our patented Concierge Security model. They work with your existing tools and become an extension of your existing IT team. Visit arcticwolf.com/darknet https://arcticwolf.com/darknet to learn more. Support for this show comes from Cloaked https://cloaked.com/darknet, a digital privacy tool. Cloaked offers private email, phone numbers, and virtual credit card numbers. So you can be anonymous online. They also will remove your personal information from the internet. Like home address, SSN, and phone numbers. Listeners get 20% off a Cloaked subscription when they visit https://cloaked.com/darknet. Calling 1-855-752-5625 for a free scan to check if your personal information is exposed!

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Jack Rhysider?

  Oh my gosh, oh my gosh, oh my gosh, I'm squealing over here. After years and years of trying to get today's guest on the show, he finally said yes. I'm so excited for this one. I've been sliding into his DMs for years. Hey, can I interview you? And I swear, he always has the same answer every time. He's like, who are you? And I say something like, oh, I'm a podcaster and I really want to hear your story. And he's like, no, thank you. And fair answer, I wouldn't want to talk to me either if I was in his position. And then I saw him at a party at DEF CON. And when I, when I first approached him in person, he was hiding behind a sign, trying not to be seen.

• 0:41Speaker 01

  So I, I stand out in a crowd. So I've learned that like signs are my best friend. We can hide behind the lamppost, we can hide behind the tree, we can hide behind the sign. But if I stand in the middle of the room, uh, like it's going to draw a lot more attention than, um, than I necessarily maybe want. Although I've got to the point now where I, I think I can just handle it. But I, I do remember our first interactions. I think part of the awkwardness was I'm very bad at recognizing faces and you were wearing a mask the first time you saw me.

• 1:11Jack Rhysider?

  It's true, I had a disguise on and yeah, I asked to interview him and he had no idea who I was. He's just like, who are you?

• 1:19Speaker 01

  In my defense, there is no photos of you online and I have checked. So like there is, there is no way I could have known.

• 1:27Jack Rhysider?

  It's true, I tried real hard not to have any photos of me on the internet. I'm a very private person. But I swear every time I asked him for an interview, he just kept asking me the same thing. Who are you? No, thank you.

• 1:39Speaker 01

  So I remember we had like quite a long conversation. And then you went away and you came back without the mask. And then you came back and you sort of went to reengage the conversation. And I had no idea who you were. I was like, who is this random guy?

• 1:54Jack Rhysider?

  Okay, fair point. I wear a lot of disguises, so you're right, some of this is on me. But I'm happy to announce that today, finally, I am interviewing Malware Tech.

• 2:06Speaker 01

  I'm Malware Tech and I'm an anonymous security researcher.

• 2:14Jack Rhysider?

  These are true stories from the dark side of the internet.

• 2:20Jack Rhysider?

  I'm Jack Reisider. This is Darknet Diaries.

• 2:41Jack Rhysider?

  This episode is sponsored by DeleteMe. You care about your privacy, do you? Then get yourself over to joindelete.me.com. And let me tell you why. Whatever size you think your digital footprint is, well, it's bigger. Social media, news apps, shopping, all the private data can be scraped by data brokers and sold. A few years ago, I signed up and ever since then, they have been busy scouring the internet from my name. And then they give me reports about what they find and then start deleting stuff. Take control of your data and keep your private life private by signing up for DeleteMe. Now at a special discount for my listeners. Get 20% off your DeleteMe plan when you go to joindelete.me/darknetdiaries and use promo code DD20 at checkout.

• 3:23Jack Rhysider?

  The only way to get 20% off is to go to joindelete.me/darknetdiaries and enter code DD20 at checkout. That's joindelete.me/darknetdiaries, code DD20.

• 3:42Jack Rhysider?

  This episode is sponsored by Arctic Wolf. Everyone is slapping AI-powered on their security tools. But Arctic Wolf took a different approach. Instead of duct taping AI onto the SOC, they rebuilt the SOC around AI and called it the Aurora Superintelligence Platform. If you ever tried to build your own AI pipeline, you know the pain. Data engineering, model tuning, governance, validation. Aurora removes all of it. You deploy it and instantly inherit the intelligence, guardrails, and operational maturity of one of the world's largest agentic SOC. Under the hood, Aurora is running a fully agentic architecture they call the Swarm of Experts. These agents are battle-tested. Inside the world's largest commercial SOC and only ship when they can outperform human-only workflows.

• 4:27Jack Rhysider?

  And its integration is seamless as Aurora works within Arctic Wolf's concierge experience, allowing your security team to focus on higher value strategy and proactive risk reduction. If you want to see what a real trustworthy agent-led SOC looks like, not the marketing slide version, go to arcticwolf.com/darknet. That's arcticwolf.com/darknet.

• 4:52Jack Rhysider?

  We're gonna start this story in early 2017. As he said, his name is MalwareTech and he's an anonymous security researcher. He would research malware and then publish his findings anonymously under the name MalwareTech. He never posts his picture on the internet. His Twitter profile is just a picture of a cat wearing glasses. Nobody knew who he was or what he looked like.

• 5:15Speaker 01

  So I've been a cybersecurity analyst since about 2016. I mostly specialized in a combination of malware reverse engineering and cyber threat intelligence. So my job was basically to reverse engineer botnet malware and then find ways to monitor their C2 infrastructure in a way that we could actually see who was being infected. So our goal was to sort of do external threat intelligence. So rather than being on someone's network and saying, hey, look, there's a sign that you're infected with malware, our goal was to be on the bad guy's network and be able to see all the victims of the malware and then alert them to the fact that they're infected.

• 5:57Jack Rhysider?

  Where were you living? Was it Cornwall at the time?

• 6:00Speaker 01

  So I was Devon, so just north of Cornwall, pretty close to the border, actually.

• 6:03Jack Rhysider?

  What is that? I think I watched a show, like, there's TV shows based out of Cornwall, and I think it was Dr. Martin, was it?

• 6:09Speaker 01

  Yeah, that was the one, yeah. I think that there were some episodes in Devon, but I remember my parents were very excited. They called me one time and they were like, there's some famous people filming in our town. And like, we live in the Midland, nowhere, so there's no famous people there. Any kind of filming is like a huge deal. So you've probably seen it on the TV like once or twice.

• 6:30Jack Rhysider?

  Yeah, I have. It's a very picturesque place. It's beautiful.

• 6:34Speaker 01

  Yeah, so where I live, which is in North Devon, we have this massive, long, I think it's like three, four mile long beach, beautiful golden sand. It picks up a nice Atlantic swell that we, I think, comes from the hurricanes down in the Gulf. They'll occasionally swing north towards the southwest coast of England. So we actually get some really, really big surf down there. So, living so near the sea, I was like, well, what do I do for hobbies? Because we had moved from inland, so I'm like, I need new hobbies. What do people here do? And the obvious answer was surfing. So I took up surfing. Turned out it's a really, really fun sport. But a lot of people don't associate it with England. They think England is like rock beaches, pebbles.

• 7:19Speaker 01

  Usually they're thinking of places like Blackpool. But there are some really, really good surf spots on the southwest coast, and I just happen to live right next to one.

• 7:31Speaker 01

  Basically, I wake up one day, and it's all over the news that this ransomware is infecting lots and lots of British hospitals.

• 7:39Speaker 02

  And we start with breaking news this hour. A number of procedures have been cancelled or redirected to other NHS providers following a cyber attack on some of London's major hospitals.

• 7:49Jack Rhysider?

  The ransomware would soon be called WannaCry, and it was hitting tons of hospitals around the UK. Their computers would get infected and then completely encrypted. You couldn't use it at all, and you had to pay Bitcoin to get it unlocked again. This infection forced hospitals to turn away patients and cancel procedures. It was awful.

• 8:12Speaker 01

  So I think the consensus is that it was someone working on behalf of the North Korean government.

• 8:18Jack Rhysider?

  It's very interesting how this came about, too. We believe it was the NSA that developed the exploit, which they called Eternal Blue, which, by the way, the NSA found this exploit in Windows, Microsoft Windows, an American company, but didn't tell Microsoft that they have this really bad vulnerability in Windows. And it absolutely flabbergasts me that NSA discovers vulnerabilities in US companies. And then not tell those companies that their product is vulnerable to attack. But it gets worse. Then the NSA somehow lost control of this exploit. And it ended up in the hands of someone calling themselves the Shadow Brokers.

• 8:57Speaker 01

  And just the set of circumstances that led to WannaCry was so insane. Because of course you had the Shadow Brokers leak and the Shadow Brokers isn't, they haven't been attributed yet, but it's widely believed to be Russian intelligence. So Russian intelligence hacks the NSA, steals one of their most prized vulnerabilities, leaks it onto the open internet, at which point North Korea pick it up and decide to make ransomware with it. And we're not even to this day sure whether WannaCry was supposed to be released yet. And there are a lot of just signs in the code that it might have been a work in progress that accidentally leaked a little earlier than they had intended it to.

• 9:39Jack Rhysider?

  We think the North Koreans unleashed ransomware on the world just to try to make some money, which is wild. Other nation states are not doing cyber thug activity like this, trying to make some money through ransomware. But North Korea does it. But one reason we think the exploit got released too soon was because it was discovered pretty early on that there's no way to track who paid the ransom.

• 10:02Speaker 01

  Usually ransomware would generate a unique Bitcoin address for every single victim. And then they can tell if that victim paid by telling if there is a payment in that Bitcoin wallet. Uh, but there was a bug with the code where it only generated something like three Bitcoin wallets. So all of the payments are going to these three Bitcoin wallets. They have no way to trace who paid and who didn't. So while I think it was intended to be ransomware or intended to at a later date be ransomware, at the time that it was released or got out, it was essentially a file shredder. Like it, there wasn't really any realistic way to get your data back.

• 10:39Jack Rhysider?

  What scumbags, you know, like for one, for a country to extort hospitals to try to make a little bit of money, I mean, come on. But two, to release ransomware so bad that it doesn't even work right. It just cripples businesses with no way to undo it. So North Korea didn't make much money from this and simply gave the world a black eye for no reason.

• 11:02Speaker 01

  I think a lot of what went into them not making much money was it came out very early that the files weren't decryptable, like almost immediately when the first infections happened. Analysts, they raised the alarm, they went to the press and they were like, don't pay the ransom, like you're not going to get your data back.

• 11:20Jack Rhysider?

  Of course, all this news is right up malware tax alley. Malware research is his bread and butter. He wants to know more.

• 11:27Speaker 01

  Now, the thing with ransomware is back then, it was mostly spread by phishing email. So if you see a organization or two infected, that's pretty normal. But if you're seeing like 10, 20, 30 different parts of the same organization being infected, that's either a lot of people falling for phishing attempts, or it's not phishing. And my first instinct was this isn't phishing. This is hitting way too many organizations, way too many parts of the same organization. It has to be something bigger. So I went and asked my friend Caffeine, can I have a sample of this? And the second I looked at it, I was like, oh, this is, this is bad. Like, this isn't your standard ransomware. Because at

• 12:12Speaker 01

  that time, ransomware was purely spread by phishing or botnets. I don't think anyone had ever made wormable ransomware before. And I was like, this ransomware spreads from computer to computer completely unaided. It doesn't need a user to click a malicious link or open a weird email. It will literally just get onto a computer, look for other computers to hack and then hack them and infect them and just repeat that process over and over. And that was the point where I was realizing we are dealing with something that I don't think has ever been seen before.

• 12:46Jack Rhysider?

  This thing was spreading fast. Hundreds of networks were spreading it to hundreds more. Soon thousands were infected, all trying to spread it to thousands more. The internet was burning, like an out of control wildfire that day.

• 13:04Speaker 01

  I was tasked with stopping the ransomware. And historically, when I worked with ransomware, it's almost impossible to stop. Sometimes you can decrypt it retroactively. There's flaws in the encryption. You can break the encryption and get people's files back. But in terms of stopping actively spreading ransomware, that is almost impossible. Sometimes there'll be a vulnerability where we can hack into their command and control server and put a stop to it. So that's what we were looking for.

• 13:37Jack Rhysider?

  But as he looked through the ransomware code, he noticed something. There's a strange domain name in this code, a URL, just a long string of gibberish letters with .com at the end. He looked. The domain wasn't registered.

• 13:55Speaker 01

  And when I saw this unregistered domain in the WannaCry code, I was like, nice, this is probably a command and control server. So I registered it. And then I started looking, what can I do with this code? Like, what can I do with the control of this domain? I'm thinking it's a command and control server and maybe we can exploit a vulnerability in the WannaCry code, maybe crash the malware or anything that could stop it from spreading. But it actually turned out, while we were trying to figure out what is the purpose of this domain? What does it actually do? We had already stopped WannaCry because the domain was a kill switch.

• 14:32Jack Rhysider?

  Without him even realizing it, the moment he made this domain active, the WannaCry malware stopped. Just suddenly and surprisingly stopped spreading.

• 14:45Speaker 01

  Someone had basically just posted on Twitter that WannaCry has been stopped. Like, someone has activated a kill switch in WannaCry. And we actually didn't know we had activated the kill switch until several hours later.

• 14:58Jack Rhysider?

  The purpose of this domain in the code was before the malware spreads, it first checks to see if the domain is up and alive. And if it is, the malware stops everything it's doing. And since Malware Tech just registered it and set it up, that triggered the kill switch to essentially deactivate one of the most brutal, devastating ransomware attacks the UK has ever seen.

• 15:20Speaker 01

  By the time we actually got around to looking at the code, it was like it had already reached the media that we had stopped it. And we were like, oh, okay.

• 15:28Jack Rhysider?

  Yeah, the media was reporting that someone stopped WannaCry before he even knew he did it. But wait, if he's got control of this domain, can he set some sort of monitoring tool up so that he can see what traffic is going to this domain?

• 15:43Speaker 01

  Yeah, so we were actually very lucky. And we did this professionally. Like, a lot of our work was about finding ways into botnets and then collecting these analytics. So we actually already had the system set up to do that, which was great. So I was like, awesome, we have this, all this analytics. We can see how many systems WannaCry was hitting. But while I was focusing on that, everyone's like, who is this guy who's stopped the world's biggest ransomware attack? Meanwhile, I had no idea that that was going on until I checked Twitter and I was like, oh, oh.

• 16:20Jack Rhysider?

  The thing is, is he was tweeting from his username Malware Tech all the analytics that were coming into this domain. And this made people realize Malware Tech is the guy controlling the kill switch. He's the one that stopped it, since he had all these analytics and could see what was going into that domain. But the thing is, not everyone put those pieces together like that. Some people thought, well, if he controls that domain, then that must mean he's the one who wrote the malware.

• 16:50Speaker 01

  So as far as a lot of law enforcement and intelligence agencies are concerned at the time being, I am the one who created WannaCry. I'm the person responsible for WannaCry. That is my domain, and I'm controlling it. So it led to a very, very interesting scenario because everyone was kind of confused about how did this happen? Why is the domain there? And why does this random British teenager? Well, I think I was 22, actually, so not quite a teenager. But they're like, why does this random British dude control the domain that is in this massive piece of ransomware that is destroying networks all across the world?

• 17:28Jack Rhysider?

  Did you discover all this in your parents' bedroom, by the way? Or I mean, in your parents' house?

• 17:32Speaker 01

  Uh, yeah, so the unfortunate stereotype of the nerd in his parents' basement is true. It was technically not a basement, because our house had multi-levels. The front, the front door was a level higher than the back door. So it was technically a basement, but technically also not a basement. But I was basically in my parents' basement.

• 17:56Jack Rhysider?

  Once the news got out that this guy malware tag is the one who stopped the world's biggest ransomware attack in history? His whole life changed.

• 18:08Speaker 01

  It went wrong in every way possible for me. I had set it up so the domain was registered through a proxy that shouldn't have traced back to me. Uh, but I think my Twitter gave them enough to find me. And my goal personally was to be an anonymous researcher. I had basically seen my whole career just being an anonymous researcher, who no one needs to know my name, they don't need to know what I look like. I can just publish my blogs in peace and no one needs to like even know who I am. And then I got an email from, I believe, the Daily Telegraph. And they were like, "We found your real name, we found your address, we found your parents' name, and we're gonna publish it tomorrow and we'd like comment."

• 18:50Speaker 01

  And I begged them, like, "Do not publish my name, don't publish my photo, please just like, respect my privacy." But of course, they had the biggest story related to WannaCry so far. Uh, the Daily Telegraph was the first person to actually correctly identify me. So they knew they had a story that would get a lot of eyes. And I, I, I kinda knew where this was going. I was like, "I'm gonna beg them anyway, but I know they're gonna publish this, and I know it's all downhill from here." I believe this was the Monday, so WannaCry happened on the Friday. I woke up Monday, they had published my name, uh, they had published my photo. Uh, the Daily Mail had published my house address for some reason.

• 19:35Speaker 01

  I remember reaching out to journalists and being like, "Dude, like, what the hell is this? Like, why would you possibly need to publish my home address in the UK's biggest newspaper after I've stopped a major criminal attack? Like, this, this doesn't make any sense." And he like apologized and he took it out, but I was like, "Dude, like..." Like, what, what, what goes through someone's mind to think everyone needs to know where this person lives? But yeah, so that day, I, I woke up and my name was out there. Everyone knew it was me. I couldn't walk down the street without being recognized by someone in town. And I was like, this is, this is it. This is the end of an era.

• 20:17Speaker 01

  Like, I'm no longer malware tech, the anonymous researcher. I'm now Marcus Hutchins. And I remember just thinking, man, this is, this is gonna be such a, like, earth-shattering change to just the way I saw my life going.

• 20:40Jack Rhysider?

  Once his name was out there, another paper, the Daily Mail, found a picture of him and published it. The headline read, Surf Dude Saves the Day.

• 20:53Speaker 01

  I think that was the two-page spread with my face on it, right?

• 20:56Jack Rhysider?

  Yeah, front cover.

• 20:56Speaker 01

  Yeah. So before that, no one knew what I looked like because I ran an anonymous Twitter account with a cat avatar. And I believe they were the first ones to actually get a real photo of me. And my mom, she reads the Daily Mail, so she came home and she handed me the newspaper. And there's my face across a two-page spread. And I'm like, oh, my god.

• 21:20Jack Rhysider?

  Marcus Hutchins was now world famous, and everyone wanted to talk with him, even me.

• 21:29Speaker 01

  There was this dude, this one dude, he kept ringing the doorbell like every single hour. And then when we finally were like, look, you've gotta stop doing this, he just started calling instead, like somehow he had our phone number. And there was, at one point, there was several, several journalists just like hanging around on the sidewalk outside my front door, waiting for me to come out of the house, of this funny story of me having to climb over the back fence to go and get food because these journalists just would not leave the outside of my house. And at the time, I just, I didn't understand why this was such a big deal. And as a very non-public person, it was, it was actually quite scary.

• 22:10Jack Rhysider?

  Marcus is a private person. He's a bit awkward around people, very soft spoken. He does not want this kind of spotlight on him. This was agonizing for him. He's tall and has huge poofy hair. You can spot him easily in a crowd. And people were stopping him to talk with him everywhere he went. Are you the guy who stopped the ransomware? And it wasn't just random people and journalists. Foreign intelligence was curious about him too.

• 22:36Speaker 01

  In the months after WannaCry, while the investigation was still ongoing, before we knew that it was North Korea, there were a lot of foreign intelligence agencies. They weren't really sure what my role was. And there was actually one incident I remember quite clearly when I was traveling in a foreign country and some researchers from a neighboring country had invited us out to lunch. They were like, hey, we're really interested to hear about your research. Would you like to come to lunch with us? And they gave us an address. And the address was across the border in their country. And I didn't see it as immediately suspicious because we were very close to the border of this country. So I'm like, OK, there are researchers from this country.

• 23:19Speaker 01

  They're probably going to know more good restaurants in this country. Let's go meet them in their country for lunch. And I got a tap on the shoulder by someone who I have no idea who they are or who they worked for. And they were like, just so you know, those are intelligence operatives of that country. Those people inviting you to lunch work for their foreign intelligence service. I would maybe go get McDonald's or just go anywhere else.

• 23:47Jack Rhysider?

  So you don't know who tapped you on the shoulder? It was just a stranger from the crowd and then they disappeared after that?

• 23:52Speaker 01

  Yep. It was one of the weirdest experiences I had in my life.

• 23:57Jack Rhysider?

  That must have been for just to have some random person tell you that. And then suddenly, you know, the camera's zooming way out like, whoa, hold on, let me.

• 24:09Speaker 01

  I assume it was probably someone from my country. I don't know.

• 24:12Jack Rhysider?

  Why is someone from your country following you to another country while you're on vacation? That is crazy. I think it was someone following those people around and then they're like, wait, who's this guy? They're talking, oh, I see.

• 24:22Speaker 01

  It's entirely possible. We um, we ended up on a lot of people's radars after WannaCry. Uh, my colleagues, not so much because they weren't as in the public eye as me, whereas I was the, I was the one who got tracked down first, so I took most of the heat. Uh, but I, I ended up having to actually go into a few different countries and speak to their law enforcement and uh, tell them my side of the story because there was obviously a lot of suspicion. They're like, no one knew where WannaCry came from and I was the only tied to it. All they knew is that this worm just came from nowhere. Uh, and there's only a single domain in the code and it's linked to Marcus Hutchins in Great Britain. So I, I basically ended up going on this sort of uh, almost like an apology tour,

• 25:06Speaker 01

  but without an apology because I'm not, I have, I'm not responsible. So I had to sort of give them my side of the story, explain why we registered the domain, uh, how it came to that. And eventually, obviously, I think it was, it might've been October. Like it was a good like six or seven months after WannaCry that the, the NSA and GCHQ and I think the Australian intelligence services, they all came out and they pointed the finger at North Korea. So after that, that the heat kind of died down, but in that bit between uh, stopping WannaCry and it being publicly attributed to North Korea. I spent a lot of my time dodging very uh, I don't know how to describe it,

• 25:49Speaker 01

  but very suspicious uh, situations. I suspected that people had uh, nefarious intentions with either wanting to interview me or inviting me to their country to come and speak at their conferences. And there was a lot of that in that period, so it was a, it was a very, very strange time in my life.

• 26:07Jack Rhysider?

  Man, how crazy is that to be invited to speak at another country? And then to wonder, is this a ploy for some foreign intelligence operatives to arrest me? Or even worse, is, is North Korea mad at me and they want to pay me back for screwing up their ransomware? And they're inviting me to this thing just so they can kidnap me? Marcus had to be very careful from now on. This sudden fame was attracting a lot of strange people. WannaCry hit in May of 2017. Three months after that was DEFCON, the annual hacker conference in Las Vegas in the US. Marcus had been there once before in 2016 and he liked it. So he flew out again in 2017.

• 26:52Jack Rhysider?

  But little did he know that this DEFCON was going to radically change his life.

• 26:58Speaker 01

  So it was insane. Like, I cannot even accurately describe the feeling of it.

• 27:07Jack Rhysider?

  Try, though, try. Let's hear it.

• 27:11Speaker 01

  Yeah, so there's what we did personally and then there's what we did within the conference. So personally, what my friends had found out is that hotels in Vegas are ridiculously expensive. And they basically calculated what could we afford if we just put all our individual hotel room costs together and go to an Airbnb instead. And we found we could get one of the biggest mansions in Las Vegas with the largest private pool in, I believe, the entire state. So we went and we got this insane mansion. And then we're like, well, the mansion's not complete without supercars, right? And there's a car dealer in Vegas that they let you rent supercars for like a day,

• 27:55Speaker 01

  two days, three days a week. So my friends, they went out and they rented supercars. So we had this driveway full of supercars. And they're not particularly expensive to rent for like short periods of time. But of course, I didn't realize that in the background, I was setting up this this scene of me being this very, very wealthy person, when in reality, the costs were split between about, I think, eight to 12 people. So we had this crazy Vegas trip. We stayed in this massive mansion. We were driving around in supercars. We were shooting automatic weapons. You know, we just went all out on Vegas. Now, the conference itself was very, very different.

• 28:39Speaker 01

  Now, I had suspected I would get a fair amount of attention. At the conference, given how recent WannaCry was, it was only, I think, three months ago. But I had no idea the level that I was going to experience. I remember this was back when it was in Caesar's Palace, the actual casino before the forum. And anyone who's been will remember, there's these hallways that are maybe like twenty, forty feet wide. And it's just shoulder to shoulder people all the way down the hallway. And I could not walk through the hallway because the traffic was moving so slowly. That I would take a step, someone would recognize me, they'd come over and talk to me.

• 29:25Speaker 01

  And by the time I got to take my next step, someone else had come over. And I had to get to this one event and it took me two hours and fifteen minutes to walk a maybe like a hundred feet down the hallway. And I was just like, I need to go to my hotel room and hide like. There's like, an average fifteen minute conversation will drain my social battery to the point where I need to sleep. And I'm now at a level where I physically feel like I'm gonna pass out. It was like one of the most crazy experiences I've ever had. I just remember feeling like so overwhelmed because I, I knew there was gonna be people who would want to come up and talk to me.

• 30:10Speaker 01

  I just didn't think it would be that many.

• 30:12Jack Rhysider?

  What was, what was some of the stuff they were saying to you?

• 30:15Speaker 01

  Oh, it was, it was all overwhelmingly positive, like super heartwarming stuff. Like everyone was just really, really positive. They were all very kind, very polite. I don't think I had in the entire DEFCON, a single negative interaction. Like people make out the hacking community to be all these like bad people and evil. Um, but generally speaking, I cannot think of a single negative interaction I had. Like everyone was so polite and so wonderful, but then on the other side of this, I'm just an introvert. So I'm not used to this level of attention. So inside I'm like, this is really, really like heartwarming and supportive. But also I'm like, I feel like my entire body is on fire.

• 31:00Jack Rhysider?

  Yeah. Wow, so what a weekend. Um, you're gonna fly back to the UK after that, right?

• 31:08Speaker 01

  Yeah, so I I believe uh second of August that we spent ten days there. So second of August, I was due to fly back to the UK.

• 31:18Jack Rhysider?

  Mm hmm. And so you have to go through the McLaren Airport in Vegas. You get through security just fine?

• 31:26Speaker 01

  Uh, no, so security was a little weird because usually when you go through security, they uh they make you take any big items out of your bag, laptops, iPads, phones. Um, and that is my experience with that airport. Like, they always make you take your laptop out of your bag. Whereas with me, they didn't. They it seemed like they were speaking to me specifically and not the guests in general. They like as I went to put my bags, uh like to unpack my bag, they said, I'll just just leave everything in there and put it through. And it felt like very weird at the time. I was like, it didn't look like they said that to anyone else other than me. It looks like they specifically singled me out.

• 32:11Speaker 01

  And I I had a feeling I knew what was coming. Um, I had a feeling that it was actually gonna be related to Wanna Cry. That the the FBI had some questions for me and they were gonna pull me aside, but I was actually uh I wasn't sure. So my my bag goes through security just fine in the weirdest way possible. Um, I go to the lounge and I think maybe an hour before my flight, uh a bunch of people in CBP uniforms uh uh approached me. And I'm like, huh, because CBP is is customs. Um, and I'm trying to think, what would I have done that would uh like would get me on the wrong side of customs?

• 32:52Speaker 01

  And the only thing I could think of is uh this was the year that they had legalized recreational uh cannabis in in Las Vegas. So I was like, did I forget to take some some drugs out of my bag? So I'm thinking they're pulling me aside because I forgot to take some weed out of my bag. They found it, whatever.

• 33:12Speaker 01

  And they take me to this back room and they take off the jackets and they they unroll these badges and it's FBI. And I'm like, oh, okay. So I did not know that was even something you were allowed to do to pretend to just be a different agency. Or if the people who took me would generally would genuinely also CBP. But I get this back room in the airport and they identify themselves as FBI. And at this point, I still am not exactly sure why I'm being detained.

• 33:43Jack Rhysider?

  I'm sorry, but I have to take a quick ad break here, but stay with us because Marcus is about to be very surprised about why the FBI is talking with him. This episode is sponsored by Black Hills Information Security. Black Hills InfoSec loves sharing their knowledge through free webcasts, blogs, zines, comics, and courses designed for beginners and those more advanced. Through their anti-siphon training, they teach you the cybersecurity skills you need from SOC analyst tools and methodologies to setting traps and running deception operations. It's hands-on, practical training built for people who want to advance and hone their skills. The world of cybersecurity has changed a lot in the last year, and every day seems

• 34:26Jack Rhysider?

  to bring new questions about what comes next. And that's why Anti-Siphon Training is hosting a free summit on December 9th, asking what in the actual cyber happened in 2026? Join experienced practitioners as they share practical lessons, real-world experiences, and insights into the top security news of 2026. And because you're a Darknet Diaries listener, they've got a little something extra waiting for you at blackhillsinfosec.com/darknet. Go to blackhillsinfosec.com/darknet. You have such a happy demeanor to you, so I imagine even in those first 15 minutes

• 35:07Jack Rhysider?

  or so of like, oh, okay, we're actually the FBI, I still imagine you smiling and being like, oh, yeah, you know what, there were a thousand people who wanted to ask me about, you want to cry? I'm sure you're just another one. What do you want to know? Did you have that kind of attitude or what was that first 15 minutes like?

• 35:23Speaker 01

  So I believe I was a bit hungover, but you are right. I always just have this happy demeanor. So I'm like, even when things are generally really, really bad, I always just am chill and happy to be there. So I, yeah, I, I think I was a bit hungover, but otherwise I was like, okay, it's the FBI, whatever, I'll talk to them. But I, I hadn't quite yet figured out why they wanted to talk to me.

• 35:46Jack Rhysider?

  Okay. And what, I mean, what were the questions they were asking you?

• 35:51Speaker 01

  Uh, so they, they started off with a bunch of random questions. Um, it, it felt like they were deliberately trying to confuse me. They themselves were trying to obscure the reason why they had pulled me aside. So it felt like they were basically just fishing for information in a way that was designed to prevent me from uh, realizing that I'm in trouble and I need a lawyer. So they kind of presented themselves as these very uh, just, we're asking questions. We're just some friendly FBI agents asking questions. Um, and I thought it was about wanna cry until a good thirty minutes, I think, into the interview.

• 36:32Speaker 01

  So you know in the movies when they, they slide the document across the table and they ask you, do you know what this is? And usually it's like a photo of a murderer or whatever.

• 36:40Jack Rhysider?

  Yeah.

• 36:41Speaker 01

  Um, so they, they did that. I didn't think that was a real thing they did, but they did that. Except in my case, they had uh, basically printed off compiled code. So it was basically just a, like fifteen pages of just straight gibberish. So I'm like going through these pages and they're like, do you know what this is? And I'm like, no, like honestly, no, like this is literal gibberish.

• 37:07Speaker 01

  But then one of the things with uh, compiled code is any text that is present in the code is present in the uh, however you were to print it off. So I get to the text section of the code and I start recognizing the strings and I'm like, oh. They printed off the Kronos executable. Like they've taken the compiled Kronos malware, opened it in Notepad or something, hit print. And this is what I'm looking at. And that was kind of the point where I realized, oh. I'm in like some serious trouble, but then I'm also trying not to laugh because someone has just tried to print an executable and hand it to me. Yeah, so I'm like, I'm like toggling between almost smiling and oh shit, I'm like, I've

• 37:52Speaker 01

  really messed up.

• 37:53Jack Rhysider?

  It is absolutely ridiculous. So they printed off a program and handed it to him. It wasn't readable code. It was compiled. Only a computer could read it. There's no way that anyone can read this gibberish, except there was one word in there, which made Marcus realize what he was looking at. The Kronos malware. Kronos was a devastating banking malware. It was designed to get access into a victim's bank account, and then the person operating the malware can siphon funds out of the victim's bank. The FBI agents handed it to Marcus and asked him if he recognized it, and he did recognize it. Because before the world knew who Marcus Hutchins was, he was only known as Malware

• 38:38Jack Rhysider?

  Tech, an anonymous security researcher. But before that, he was a malware developer.

• 38:48Speaker 01

  I started out as a malware writer. I specialized in writing rootkits. So that's malware that hides malware. So I mostly did stuff like Trojans that would do Bitcoin mining, stuff that's not super harmful, but also not really very great either. It's like the, not the worst of the worst, but obviously not something that I didn't deserve to go to jail for.

• 39:11Jack Rhysider?

  Basically, he would write malware, which in itself is not so bad. It all depends on what you do with the malware, right? But he was working with someone who wanted to take his malware and sell it so they could make money. And so now his malware was being offered to criminals for sale. But still, by itself, his malware wasn't making any sales.

• 39:33Speaker 01

  Basically, we had a seller. So his job was to sell the malware. I would write the malware for him, and then he would sell it. And then he announced to me that he had contracted this other programmer to combine my code with the banking code to make banking malware that he wanted to sell. So essentially, I had a choice. I was like, okay, so my code has just been made into banking malware. I am already implicated in this. What do I do? So I was like, I don't really wanna, I don't wanna have anything to do with this. Like, I specifically said that any kind of credit card fraud or any kind of theft of money was over my moral line. I don't want anything to do with this.

• 40:17Speaker 01

  And that was the point when he basically hinted that if I didn't continue to maintain the code, he would drop my name and address to the FBI. So at that point, I was like, I'm like, I'm in too deep. Like, I'm, there is nothing I can do at this point.

• 40:34Jack Rhysider?

  So as a teenager, he developed part of this Kronos malware. And now it was being bought by criminals and actively used to rob people's bank accounts. And he's actively supporting the code, adding in features, fixing issues. This made him worry.

• 40:53Speaker 01

  The second he told me that he had combined it with the banking malware, I was like, yeah, this is, this is going to come back and bite me. There is no way that I am, like, I, I knew this was gonna come. Like, I am going to be picked up by the FBI at some point. Like, this is gonna come back to bite me. And like, even then, as a, I think I was maybe nineteen when this happened. I knew the repercussions. I was like, this is, this is bad.

• 41:21Jack Rhysider?

  He kept looking for a way out of this deal to stop working on the Kronos banking malware. But he feared that the guys he was working with were gonna turn him in if he quit.

• 41:29Speaker 01

  So I kept maintaining the code for about, I wanna say, like, six months a year, until I found a way to, to get out in a way that wouldn't result in him sort of doing anything to me. Like, he wouldn't report me to the FBI or do anything that would harm me other than the harm that has already been done. So eventually, about a year later, I find an out and I completely distanced myself from the project. I, um, I think I spent about a year just doing blogging and then I get a job in cybersecurity. So I, I basically, I leave the life behind. I go into a professional cybersecurity role. And that's when I started doing this sort of malware reverse engineering and cyber threat intelligence.

• 42:15Jack Rhysider?

  And so, in August 2017, on his way back from the most epic DEFCON ever, about to step foot on the plane, the FBI grabbed him and handed him a copy of his malware. And he knew exactly what that was, and he feared this day would someday come. At this point, he's missed his flight, his friends are worried about what happened to him, and he's starting to sober up. A smile faded.

• 42:45Speaker 01

  So yeah, they took me to overnight holding, which is basically, it's like actual jail. So it's the jail you go to when you get arrested by the police for like being drunk and disorderly or whatever.

• 42:58Jack Rhysider?

  Man, to be in jail with all the drunk and disorderly people from Las Vegas? That's gotta be a real nightmare.

• 43:04Speaker 01

  Yeah, from the, from the nice fancy mansion and the driving around in Lamborghinis to the concrete cell in like county jail, or I don't know if it's even called county jail, but yeah, that was a very, very high high to a very low low.

• 43:21Jack Rhysider?

  Now, the FBI needed to process him in order to charge him for these federal crimes, but it was getting late and the FBI agents were tired. So they just needed to dump Marcus somewhere for the night, and then the FBI would pick it up again in the morning and finish processing him. So they take him to the jail.

• 43:36Speaker 01

  And the jail was full, like there were no free cells. So the police handcuffed me to a chair for the entire night. They were like, you're just gonna be handcuffed to this chair in the lobby for the next 12 hours. And I was like, great, that's, that's very comfortable. As a six foot four guy, I can think of no more comfortable way to sleep than in a lobby chair. So I was a little upset at that point. I was like, okay, I can understand the rest of the stuff, but like you're gonna handcuff me to this tiny chair for 12 hours? But then I found a solution. I need to go to the bathroom, so I asked to go to the bathroom.

• 44:19Speaker 01

  And it turns out the bathroom is just a cell that they leave vacant for people to use, because each cell has its own toilet in it. So they have a spare one, which is like the visitor toilet. So I asked to go to the bathroom, and they, they throw me in that cell, they lock the door. And I'm like, well, how do I get back out? And I I realised that you don't. Um, you basically just stay locked in the bathroom until the next person uses the bathroom. So my plan for the night ended up becoming, I asked to go to the bathroom. The bathroom is just a normal cell, so it has a concrete bench. I sleep on the nice comfy concrete bench. Then when someone else next needs to use the bathroom, they take me out, they handcuff me back to my chair. I asked to use the bathroom again.

• 45:04Speaker 01

  And that was basically my night is I just slept on a concrete bench in the designated public toilet cell. Oh yeah, so um in overnight holding, uh because a lot of the drunk people might like pass out and you know, like uh end up in a in a state where they need medical attention. The guards are supposed to do around every twenty minutes and check on all the cells. Um, so there's a very loud audible alarm that goes off um to signal the guards to start their check. And it goes off every twenty minutes. Basically, you're just sleeping for twenty minutes at a time because you cannot sleep through that loud of an alarm. And I I would put that as the rock bottom of my life, like basically just sleeping on a concrete bench in a public toilet.

• 45:51Speaker 01

  So I think I I get woken up uh four AM uh in the holding facility. They wanted to like process me, which I'm like, why are you processing me like you're not keeping me? The FBI just left me here for you to deal with overnight, but I'm not staying. And I remember like I was in a really bad mood because like I had been woken up every twenty minutes for the entire night. Uh, my back hurt, my side hurt, like every surface of my body hurt from trying to sleep on concrete. And then this guy's asking me all these questions, like, what's your sexuality? And I'm like, dude, like, you're not, like, I'm not doing this. So I told him like, I'm I'm not doing your your intake form. Like, I'm not going to be in prison here.

• 46:33Speaker 01

  There is no reason for me to be up at four in the morning doing prison intake. And I remember him saying to me, you're not leaving here without it. And I wanted to be snarky and I wanted to be like, how much money do you want to bet on that? And of course, like, a couple of hours later, the FBI just came and they're like, we don't care whatever he did here, he's ours. They take me off to the, the local, I think it's like a, a field office, or maybe like some kind of satellite office. They spend like an hour processing me, like fingerprints, hair samples, saliva sample, like you name it, photos. And then they, you get handed over to the US Marshals.

• 47:12Jack Rhysider?

  He gets taken to a federal detention center, basically a prison. He was locked up for the banking malware that he wrote when he was 19. And so there was nothing he could do, but just sit there and see what fate has in store for him next.

• 47:30Speaker 01

  Someone who I actually didn't know at the time, her name's Tara Wheeler and Devian Ollum, who, they're pretty well known in the hacking community. But I didn't know them and I had never met them. But they ran down to the courthouse and they posted my bail. Like they put up their own money. And this was cash bail. If you're not familiar with the bail system, typically if they set your bail at 30K, you can go and borrow the money from a bail bondsman. And it's usually, I think it's like a 10% deposit. So you would, you would just pay 3K and they'd put up the 30K for you. But when you have a cash bail, you have to pay the entire amount yourself. So they put up 30K of their own money to bail me out of jail.

• 48:13Speaker 01

  And like that was just, that truly just blew my mind that a stranger, like someone I've never met, would be kind enough to do something like that for me.

• 48:23Jack Rhysider?

  Tara and Devian simply saw Marcus as someone who helped the world by disabling WannaCry. So they asked the hacker community to all pitch in and help bail out Marcus. And people did. Honestly, this could have sounded crazy, but it's true. I randomly ran into Tara myself at that time. We were on a remote island, deep in the woods of all places. And in the first few minutes of meeting her, she asked me, "Hey, we're raising money to help Marcus. Are you in?" And I actually gave her some of my money myself. She made a good case on why it was important to help people in situations like this. And they raised enough money to spring them out of jail.

• 49:00Speaker 01

  I came into the US on what's called an ESTA, which is, a lot of countries have visa-free travel programs that allow you to visit as a tourist for thirty to ninety days without needing a visa. But you're not allowed to work on those, and you're not allowed to stay longer than the thirty to ninety day period. So I'm in the US on a temporary visa, but my bail condition is I'm not allowed to leave the country until the case is over. And federal court cases go on for a long time. Like, it's very, very rare for a federal court case to go on for less than a year. So I'm now in this sticky position where I need money to survive, but I'm also legally not allowed to be in the country, but I'm also legally not allowed to leave the country.

• 49:44Speaker 01

  So I'm like, huh.

• 49:48Speaker 01

  Like, do you guys have a protocol for this? And they're like, no, like, usually we don't arrest foreign nationals like this. Or if you, when we do, you would be in jail. We've actually not had anyone be granted bail in this way. So I'm like, okay, so I guess I'm just on my own here. Like, I'm just gonna have to figure it out myself.

• 50:10Jack Rhysider?

  He was stuck, can't leave, can't work. Lucky for him, a few good lawyers heard about his case and wanted to help him.

• 50:17Speaker 01

  Yeah, so one of my lawyers lived in LA, and my case was out in Milwaukee. And as much as I love the people of Milwaukee, Milwaukee's not my scene. Like, I'm, I'm a west coast kind of surfer vibe, so I wanna be near the coast, I wanna be surfing, I want the nice, warm weather. And basically, one of my lawyers made the argument that, well, like, My lawyers is from LA and the other's from San Francisco. So if I'm stranded in Milwaukee, anytime we need to do legal meetings, they're both going to have to fly to me, or I'm going to have to fly to one of them and the other is going to have to fly to one of them. And it's like a logistical nightmare.

• 51:00Speaker 01

  So my lawyers were like, well, wouldn't it make sense if he lived near one of his lawyers? And the judge was like, yeah, that's actually the more sane way to do this. So they basically agreed that I could go and live with, like, in the same city as one of my lawyers. And I don't remember how or who chose it, but it ended up being LA. So I get moved to LA and I'd never been to LA before. I didn't know what it was like. I didn't know what to expect. And I remember just kind of falling in love with the city within like two weeks, which was pretty funny because a lot of the governments, their strategy was give us what we want and we'll let you go home. But after two weeks in LA, I'm like, actually, you know, I'm kind of good. Like, I like it here.

• 51:44Speaker 01

  They're like, give us what you want and you can go home. And I'm like, no. And they're like, okay, give us what we want and or we will deport you. And I'm like, but you can't deport me until the case is over. And it just, it made things a little bit tricky for them because they had angled their whole case on this idea that I desperately wanted to go home to the UK, which was no longer the case. I actually, I made a lot of new friends in LA. I found like a lot of cool stuff to do. And I was like, you know, I'm actually pretty happy here.

• 52:13Jack Rhysider?

  So he became a bit of a beach bum. I mean, he couldn't work or leave. So surfing just became the thing he'd do right there on Venice Beach. Okay, so what, what charges did they have on you at this point? What is the, what are you facing?

• 52:27Speaker 01

  I actually don't know. Like, I, I, this is gonna sound absolutely insane, but I regularly have to Google what I was convicted of. Because it was, it was very obscure. Because the, in the US, it is not illegal to write malware. You might intuitively think malware bad, surely it's illegal. It's not. There is actually no federal law against writing malware. So what they tend to do is they tend to find other. Laws that can be interpreted in such a way as to charge you with malware. Um. Now, initially, I think they hit me with six charges and then they later upped it to ten. But they were all very obscure. They were things like a conspiracy to commit wiretapping,

• 53:10Speaker 01

  conspiracy to sell a wiretapping device, uh, conspiracy to advertise a wiretapping device. And their basic argument was that malware listens to keystrokes like it's like a keylogger. And a keylogger is like a listening in on telephone calls. Um. Therefore, we can use the Wiretapping Act to charge him with what I would not call wiretapping, but they had argued is. So I'm being charged with a statute that was originally made for stopping people from listening in on telephone calls. I'm also being charged with conspiracy to commit computer hacking. Uh, and the way that works is if I am in any way involved with someone else doing hacking,

• 53:51Speaker 01

  they can charge me with conspiracy, being a part of a conspiracy. So they basically argued, uh, because someone used my malware to hack people and I wrote the malware and then it was sold to that someone. I am therefore a conspirator in the hap- in whatever hacking happened. So although I had never used my malware to hack anyone and I had never hacked any systems, uh, they got me on conspiracy to commit computer hacking. And I remember my lawyers explaining all this to me for the first time and I was just insanely confused. Uh, because in England, it's just illegal to write malware. So if I was charged in England, they'd be like, this is the no writing malware law. You're being convicted of the no writing malware.

• 54:34Speaker 01

  But in the U S, it was just so obscenely complicated that I couldn't even wrap my head around what I was actually being charged with. I'm like, telephone wiretapping? This makes no sense.

• 54:45Jack Rhysider?

  And here's the thing, Marcus knew that by creating the Kronos malware, what he did was wrong. He knew he should face charges for that. But these charges? No, these were not the right charges. And I've heard this time and time again from hackers on this. They knew they did something bad. They were ready to face the consequences for it. But the charges that they were facing were for something else entirely. And that doesn't feel right. Like, if you steal a thousand dollars from someone and get caught, you know you're guilty, right? So when the police say, "Did you do it?" "Yep." "Okay, great. Here are your charges. We know you worked with five other guys and together you all stole two hundred thousand dollars, so you're facing ten crimes total." "Whoa, whoa, whoa, hold on.

• 55:31Jack Rhysider?

  I only stole a thousand dollars. This is not right." You know you're guilty of stealing, but not guilty of all the other stuff. And so you feel like you have to say "not guilty" to all of the charges, since none of them match the actual crime you did. It's a broken system.

• 55:47Speaker 01

  At that point, I think I had decided to, uh, to fight the case. Because, um, what had basically happened is they had made it very clear to me that they did not care that I committed crimes. Like, this was not, "You've done something wrong and we're bringing you to justice." They were very, very clear that they were only charging me, uh, to leverage me into becoming an informant and giving them up someone that they wanted. Um, and at that point, I was kind of annoyed because in my mind, that's not how the justice system works, right? Like, you do a bad thing, you go to jail because you did a bad thing. Whereas they were saying, "We don't actually care what you did. We just want this other guy." And I'm like, "Wha- what?"

• 56:31Speaker 01

  Um, because this isn't, uh, I guess for the American listeners out there, uh, this is not how the UK system works. In the UK, you don't have plea deals and it's very, very hard for prosecutors to do cases in this way. The UK system is a lot more clear-cut. You do a bad thing, you get charged with the bad thing and you go to jail for doing the bad thing. Whereas the US is a lot more geared towards, there's always a bigger fish. They just, they, they want the bigger fish. They don't really care about you or what you did. And this was, of course, my first experience with the US justice system. So I'm confused, I'm a bit frustrated, I'm annoyed. So I ended up kind of deciding to fight the case because I also noticed that these charges don't really make any sense.

• 57:13Speaker 01

  Like, there is no law against writing malware, so you're just charging me with these, these weird crimes. So I'm like, "Okay, let's just fight it and see what happens."

• 57:25Jack Rhysider?

  Okay, so you had two lawyers at the time.

• 57:29Jack Rhysider?

  That must have been costly.

• 57:31Speaker 01

  Uh, no, so I was actually very lucky and these two great, great lawyers, Marcia Hoffman and Brian Klein, they reached out to me and they were like, "We would like to take your case pro bono." And these are like top, top lawyers, the kind that you would want on your side in a cybercrime case. And I remember they reached out to me and they were just like, "We just want to take your case for a charge." You'll, obviously you have to pay like court fees and filing fees and for your flights to and from the courthouse. But other than that, like, "We're not going to charge you for our services." And it, it just felt like a gift from the heavens. It was, it was like so much of the, the theme behind this,

• 58:14Speaker 01

  this story was just random people I'd never met, just sort of going out of their way to help me. And it was, it was just such a surreal experience to have all of these people just coming to my aid out of seemingly nowhere.

• 58:33Jack Rhysider?

  Okay, the fight is on. Two powerhouse lawyers, ready for action. Marcus unhappy with the way the justice system is acting and wants to make things right. But it's a federal case. Federal cases are extremely slow. We're talking years for them to finish. He's got to fly back and forth between Wisconsin, where the trial is, and California, where he lives. Flying gets more and more tricky since his visa expired and he's not supposed to be in the country anymore, but he's also not allowed to leave the country and he can't work in the US either.

• 59:04Speaker 01

  So for a lot of the time, I was kind of wrestling with this internal conflict of like, A, I'm guilty and I, I did everything they say I did. But B, I'm also kind of really just fighting, not because I believe I'm innocent, but because I, I, I don't feel like this is how the justice system should work. But what really kind of wore me down is just the time. Like, we're talking a year, two years into the case and I'm, this is like, it's very Very, very hard to explain how stressful being in a federal case is. Like, it is a level of stress that goes way beyond even the worst, like, incident response cases I've ever worked.

• 59:47Speaker 01

  And it's daily, like, every day you just wake up and you're just like, is today the day I go to jail? Like, what's happening in my case, blah, blah, blah? And it just, it wears you down so fast. I mean, people have committed suicide. There are people in the hacking community who have committed suicide from the, the just sheer constant stress of going through that system. And I don't think there is anyone who is set up to actually see that through to the end. At some point, it like, it just gets you to the point where you're just like, I just, I give up. And for me, I think that was, I think it was about like a year and a half, maybe a bit more in.

• 1:00:29Speaker 01

  We had filed a bunch of motions with the judge to get like certain pieces of evidence dismissed and arguing that certain charges weren't, weren't correct. And all of the motions were denied. So at that point, we're basically starting from zero. We've got to find a new strategy. We've got to, we're going to be going for like at least another year. And at that point, I was like, you know, I just, I can't do this anymore. So I ended up just pleading guilty.

• 1:00:58Jack Rhysider?

  After fighting it for almost two years, he switched and gave in and said, fine, charge me with whatever stupid stuff you want. I'm tired of this.

• 1:01:09Speaker 01

  Honestly, at that point, I was like, if I had just gone to jail from the start and spent a year or two in jail, it would have been infinitely easier on my mental health than like going through this case. Um, so it was, it was a lot and I just, I just couldn't take it anymore. So I folded.

• 1:01:30Jack Rhysider?

  Okay, then. Guilty on all charges. Well, the case can be closed now. Except for one last thing. The court now has to decide what his punishment is. So a sentencing hearing was scheduled. Some early calculations were saying that he could get anywhere from two to eight years in prison. But of course, his lawyers were trying to fight for him to get the least amount of prison time as possible.

• 1:01:54Speaker 01

  In my case, their argument was the FBI actually couldn't produce any evidence of Cronus having damaged systems. That's not to say it didn't. I'm sure it did. But they had not produced any evidence. And part of their argument was that we estimate it caused X tens of thousands. I think it was hundreds of thousands in damages. And they could not produce any evidence to back that up. And their sentencing recommendation was based on their claim that I had caused these hundreds of thousands of dollars in damages, which they couldn't prove. So my lawyers had a argument there of, well, if there is damages, where are they?

• 1:02:34Jack Rhysider?

  So his sentencing day comes, and he heads into the courtroom.

• 1:02:39Speaker 01

  So I had basically convinced myself from the start that I was going to jail. So I went into that hearing with the belief that I was going to jail.

• 1:02:49Jack Rhysider?

  I think you tweeted something too, like, okay, I'm going to jail. And whatever happens, I love you all.

• 1:02:55Speaker 01

  Yeah, pretty much. Like, I was sure that I was not leaving that courtroom.

• 1:03:01Jack Rhysider?

  The prosecution gave their arguments. His side gave his arguments. The judge listened to it all and came to a decision.

• 1:03:10Speaker 01

  Basically, my punishment was sentencing me to time served. And even when the judge said time served, it didn't register. Because like, they don't. It's not like in the movies where they bang the gavel and they're like, this is your sentence. There's usually, they say the sentence, and they'll talk a bit about why. And then they'll talk about like, what happens next, and blah, blah, blah. So he sort of said the sentence, and then he kept talking. And I'm like, okay. So I actually didn't really know what time served means. So I'm like, is that the sentence? I don't know. And then he's still talking. And I'm like, I'm waiting for him to say how much jail time. And it's not coming. And then I think the hearing went on for maybe 30, 40 more minutes. And...

• 1:03:54Speaker 01

  I was still confused at the end. I was like, I don't actually understand how this system works or what what time served means. And I remember my lawyer just being like, you're you're going home. And I'm like, what? And it just it never registered. Like, it didn't register in the courtroom. It didn't register when I went home, and it still doesn't register now. Like, in the back of my mind, I still feel like I have this thing hanging over me, and any minute now, I'm going to go to jail. And it was because I had just convinced myself since the uh the beginning of the case that this ends in me going to jail. And because there was never any jail, it hasn't ended in my mind. So I've always like, I've never been able to like, fully kind of clear that period of my life from my mind.

• 1:04:39Jack Rhysider?

  Well, you should take a trip out to Alcatraz, hang out there for an hour, and and do like some sort of mental cleansing of, okay, I'm here, I did it, now I'm leaving, it's over.

• 1:04:49Speaker 01

  That it sounds funny, but that actually might not be a bad idea.

• 1:04:56Jack Rhysider?

  The judge seemed to understand all aspects of this case, even before the defense gave their side. People sent in tons of letters saying why Marcus should be free and serve no jail time. The judge read newspaper clippings of how Marcus is a hero in the UK for stopping one of the world's biggest cyber attacks. And one thing the judge had to think about was.

• 1:05:17Speaker 01

  What is gained by putting him in jail? Because he's already on the good side, he's doing good work, and you're just taking him away from doing the good work. What what what do you seek to gain for putting him in jail? And that's actually what the judge's own argument was. Um, I think, I suspect the judge has had actually made up his mind about the sentence before any of us had made our arguments. Like, he had looked at the, he'd looked at the case, he'd looked at the totality of the circumstances, and he had been like, this just doesn't make any sense. So I I strongly suspect the judge had already decided to sentence me to no jail time before we even got into the courtroom. He basically said, yeah, he's been.

• 1:06:04Speaker 01

  He self rehabilitated, so there's no, he needs rehabilitation angle. He's stopped one of the largest ransomware attacks in history. And he's been doing all of this great cybersecurity work. He's got all of these letters from like various people in the cyber community. They wrote in letters explaining why they think I shouldn't go to jail. And I think like all of that just put together just made a really strong case for sentencing me to time served.

• 1:06:33Jack Rhysider?

  Time served simply means whatever time you've spent on this case already is enough punishment. You're done. You can go home now. Case closed. And you might think he got the best possible outcome here. But the stress of not knowing what's going to happen to you for two years is a lot harder than you realize.

• 1:06:51Speaker 01

  To be honest, like I'm being a hundred percent real when I say this. If I could have taken a year or two in jail instead of going through all of that stress, I would have taken it.

• 1:07:05Jack Rhysider?

  So Wanna Cry was one of the worst things that happened to him. Yet seemed to also be the very thing that saved him.

• 1:07:13Speaker 01

  It's obviously hard to speculate what would have happened had Wanna Cry not happened. But there is a chance that I would have got sentenced to jail time if it was not for Wanna Cry. I don't know that for sure, but yeah, I do think Wanna Cry was this silver lining of at the time it felt horrible. It was like my anonymity is gone, my life has been turned upside down. But then it most likely helped me out in the court case. And it helped me come to terms with like learning, I guess, better social skills and how to, how to do public speaking. So while at the time when it happened, I would say like this was the most terrible thing that had happened that far in my life. And I had gone through a lot of terrible things.

• 1:07:54Speaker 01

  But now, when I look back, I think it was like it led to a lot of important growth that was needed. And it helped me out in a lot of scenarios that would have made my life a lot worse had it not happened. So I'm not saying I'm like, I'm not changing my answer, but I'm saying versus like when it was happening. I was very adamant that this was the worst thing to happen to me. But now in hindsight, having had like years of and years of personal development, I think it turned out for the better. Like, I think it improved me as a person and it bailed me out of potentially going to jail, potentially.

• 1:08:41Jack Rhysider?

  Thank you so much to Marcus Hutchins for coming on the show and finally sharing this story with us. This is such an incredible story. I'm so glad you finally said yes to it. I started this show the year he got arrested and have dreamed about having him on this whole time. And I get it, he was busy, fighting for his life the whole time. I was constantly being bombarded with interview requests. But that's the thing about me, I don't mind waiting eight years to get the story. Take your time, unwind, decompress from the craziest time of your life and then let's talk. It'll still be a really good story when you're ready. This episode was created by me, Control Alt Deluxe, Jack Reesiter. Our editor is Zero Daydreamer, Tristan Ledger.

• 1:09:24Jack Rhysider?

  Mixing done by Proximity Sound and our intro music is by the mysterious Breakmaster Cylinder. There are two kinds of people in InfoSec. Those who have taken a production server down and liars. This is Darknet Diaries.