Marcus Hutchins is often referred to in cybersecurity circles as a “hacker,” but he doesn’t see it that way. In an interview series, he explains how his fascination with technology pulled him back from the edge of cybercrime and into a legitimate role as a security researcher—an inflection point being the major WannaCry outbreak and the so-called WannaCry kill switch.
What stands out in his story is the combination of technical curiosity, moral growth, and the hard reality of the justice system. It also shows that cybersecurity isn’t only about code, but about responsibility.
From curiosity to deep technical focus
Hutchins was born in Ascot, England. In 2017, when he was 22, he worked as a cyber threat analyst at a cybersecurity company in Los Angeles. There, he gained worldwide attention by identifying a mechanism that could slow the spread of WannaCry.
He deviates from the stereotype of a “hacker” because he isn’t primarily trying to break things. His core motivation is understanding: “How does it work?” seems to be the question that keeps driving him. In his view, that leads to extremely focused work—on one topic he can dive very deeply very quickly, while other tasks receive comparatively little attention.
This intensity started young. At 13, he got his first computer. In the years that followed, he taught himself, among other things, VB, PHP, C, C++, and assembly. At the same time, it came at the expense of his school performance; he describes himself as someone who mainly wrote code, without a clearly “productive” study path.
Working on malware: not a black-and-white story
Hutchins became involved with cybercrime forums early on. His strong suit was coding, so rather than actively participating in attacks, he developed and sold “hacks.” He describes providing software to criminals: code that supported attacks and helped bypass security measures.
That made him part of a cybercrime group, where he effectively acted as a malware developer. His tasks included maintaining backdoors and code intended to disrupt antivirus systems.
An important aspect of his account is how he kept distance from the consequences at the time. He sold code, but for a long time he didn’t see what specifically happened with that code afterward. According to him, this created a psychological barrier: it wasn’t the actions carried out by him directly, but the fact that he didn’t know right away what would be done with the code that made it emotionally less burdensome.
Over time, that distance disappeared. He became involved with organizations that used his code and, as a result, saw more of the damage. That was the moment for him to break ties and look for a legitimate job.
WannaCry and the EternalBlue chain
When Hutchins later works professionally in cybersecurity, WannaCry comes back into his orbit. At the time, the outbreak was a major, seemingly inexplicable problem: independent organizations were hit simultaneously, while no one knew immediately why.
The backdrop of WannaCry involved a leaked NSA exploit, known as EternalBlue, which searched for systems with an open SMB port. Through an additional component—DoublePulsar—attackers could then identify targets and deliver ransomware.
According to the interview, WannaCry works like a worm-like chain: the ransomware copies itself from computer to computer without the need for continuous manual steps. That allows it to spread rapidly across networks and beyond.
There was also a particularly grim twist: the encryption worked, but the decryption didn’t. Hutchins describes the overall effect as a combination of ransomware and wiper behavior—files were encrypted, but recovery wasn’t possible.
The WannaCry kill switch: why one domain made the difference
The story of the WannaCry kill switch starts with something researchers often consider “striking”: a domain that was not registered in the malware code. Such domains appear more often, because researchers use them to monitor behavior or gain insight into how malware works.
Hutchins registered the specific domain that was embedded in the code. He did it for a relatively low amount of money. Soon after, he noticed web traffic coming in: the domain received a huge number of requests per unit of time. That meant the malware itself kept calling that address.
What matters at the core: WannaCry stopped spreading. The logic behind it was that the domain functioned as a kill switch. The malware seemingly checked whether the internet address “responded.” When the web server traffic came in and the callback worked successfully, WannaCry shut itself down.
The conclusion is simple, but technically powerful: if you keep a web server available at that address—as long as the server is reachable—the worm can’t propagate any further. The exact reason the malware was coded this way remains the subject of theories. For stopping the outbreak, the “why” layer matters less than the “what” effect.
From hero status to a criminal case
Only a few months after WannaCry, Hutchins was arrested by the FBI. His explanation was that it came down to prosecution for activities from the past, which had already ended long before. He describes how investigators later linked his name to earlier activity, which led to a case after all.
He ended up in U.S. detention, where he was released after one week thanks to bail arranged by a third party. From there, a process unfolded through the U.S. legal system.
The legal proceedings lasted two years in total and ended with a guilty plea involving, among other things, computer hacking and advertising a wiretapping device. The judge, according to him, chose to take his rehabilitation into account and ultimately imposed a one-year probation period.
After that probation period, he decided to stay in the United States.
Why his story still lingers in security
Very few cases involve someone going through a trajectory like this—from being a suspect or involved in “gray” activity to ending up with a clear defensive role in protecting systems. Hutchins’ history challenges the common idea that “doing no good goes unpunished.” In his case, the twist is almost literal: not only did his role in WannaCry become visible, but his past still had legal consequences.
At the same time, he also explains the other side: his publicity around WannaCry made it easier for investigators to connect his pseudonym or earlier activities to him. As a result, a previously anonymous blog—MalwareTech—could be traced back to him.
The blog still exists. In his update, he says the focus has shifted: from malware-like posting and criminal behavior to cybersecurity and research. In other words, it’s the same curiosity, but now pointed in a different direction with different intent.
What organizations can learn from incidents like this
While Hutchins’ personal path is unique, his story offers lessons for organizations. The key takeaway is that malware behavior can sometimes be influenced by unexpected “switches” in the code. If researchers spot such signals early, it can buy time and limit the spread.
His story also shows that security doesn’t stop at technical analysis. When outbreaks become widespread, indicator registration, keeping infrastructure available, and translating findings into response actions all come into play.
Want to read more about how researchers and organizations deal with vulnerabilities and attacks that emerge through infrastructure chains? These topics connect well:
- BdThemes supply chain attack via JSON: what you need to know
- Metabase SQL injection: zero-day patched
- Mozilla replaces Firefox GPG key after exposure
Conclusion: understanding, responsibility, and the long aftermath
The WannaCry kill switch is the clearest example of how a single detail in malware can determine whether an outbreak runs wild or is slowed down. Marcus Hutchins played a role by registering the relevant domain and making the kill mechanism’s operation visible.
But his story doesn’t end with the technical aspect. It also shows how earlier choices can come back later, and how rehabilitation and work in legitimate cybersecurity are possible. For security teams, it’s above all a reminder that cyber incidents are both technical and human—and both sides require attention.
Source: https://www.securityweek.com/hacker-conversations-marcus-hutchins/
