Episode
06 May 2025 Official episode · Official transcript
black hat botnet cons cybercrime
The episode features Marcus Hutchins, known online as MalwareTech, discussing his analysis of WannaCry, the accidental activation of its kill switch, and his later prosecution over the Kronos banking malware.
Topics: WannaCry ransomware outbreak, EternalBlue exploitation, Automatic worm propagation, Ransomware kill switches, Command-and-control infrastructure monitoring, Malware reverse engineering, Cyber threat intelligence, Kronos banking malware, Rootkits and keylogging, Malware development and criminal distribution, Cybercrime prosecution and malware-related charges
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Malwaretech SAME_AS Marcus Hutchins
MalwareTech is identified as Marcus Hutchins; the speaker says that after his identity was exposed, he was no longer the anonymous MalwareTech and was now Marcus Hutchins.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I’m now Marcus Hutchins”
“I’m MalwareTech and I’m an anonymous security researcher.”
Marcus Hutchins USES malware reverse engineering
Marcus Hutchins says his cybersecurity work specialized in malware reverse engineering.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I mostly specialized in a combination of malware, reverse engineering, and cyber threat intelligence.”
Marcus Hutchins USES cyber threat intelligence
Marcus Hutchins says his cybersecurity work specialized in cyber threat intelligence, including monitoring botnet infrastructure and identifying victims.
Explicit Confidence 98% · Malwaretech EP 158 Details
“I mostly specialized in a combination of malware, reverse engineering, and cyber threat intelligence.”
“our goal was to be on the bad guy’s network and be able to see all the victims of the malware”
EternalBlue DEVELOPED_BY National Security Agency
Jack says it was believed that the NSA developed the EternalBlue exploit.
Uncertain Confidence 84% · Jack Rhysider EP 158 Details
“We believe it was the NSA that developed the exploit, which they called EternalBlue.”
EternalBlue EXPLOITS Windows vulnerability
EternalBlue is described as an exploit for a serious vulnerability in Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
“they have this really bad vulnerability in Windows”
EternalBlue AFFECTS Windows
The EternalBlue exploit is described as affecting Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
Shadow Brokers ASSOCIATED_WITH Russia
The Shadow Brokers are said not to have been attributed at the time, but were widely believed to be Russian intelligence.
Uncertain Confidence 95% · Malwaretech EP 158 Details
“the Shadow Brokers isn’t — they haven’t been attributed yet, but it’s widely believed to be Russian intelligence”
WannaCry USES EternalBlue
The episode describes North Korea picking up the leaked EternalBlue exploit and making ransomware with it; the link between WannaCry and EternalBlue is presented in that account.
Derived Confidence 94% · Malwaretech EP 158 Details
“North Korea pick it up and decide to make ransomware with it”
WannaCry ATTRIBUTED_TO North Korea
WannaCry is attributed to someone working on behalf of the North Korean government; later, intelligence services publicly pointed to North Korea.
Attributed Confidence 96% · Malwaretech EP 158 Details
“I think the consensus is that it was someone working on behalf of the North Korean government.”
“the NSA and GCHQ and I think the Australian intelligence services, they all came out and they pointed the finger at North Korea”
WannaCry USES ransomware
WannaCry is described as ransomware that encrypted computers and demanded Bitcoin for recovery.
Explicit Confidence 99% · Jack Rhysider EP 158 Details
“The ransomware would soon be called WannaCry”
“you had to pay Bitcoin to get it unlocked again”
WannaCry USES wormable propagation
WannaCry is described as wormable ransomware that spreads from computer to computer without user action.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I didn’t think anyone had ever made wormable ransomware before.”
“this ransomware spreads from computer to computer, completely unaided.”
WannaCry used Bitcoin payments as part of its ransomware operation.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“you had to pay Bitcoin to get it unlocked again”
WannaCry infected and encrypted Windows computers.
Derived Confidence 96% · Jack Rhysider EP 158 Details
“Their computers would get infected and then completely encrypted.”
The WannaCry incident involved the WannaCry ransomware outbreak.
Explicit Confidence 99% · Jack Rhysider EP 158 Details
“The ransomware would soon be called WannaCry, and it was hitting tons of hospitals around the UK.”
WannaCry INVOLVES wormable propagation
The WannaCry incident involved unusually rapid wormable propagation across networks.
Derived Confidence 98% · Jack Rhysider EP 158 Details
“Hundreds of networks were spreading it to hundreds more.”
WannaCry USES WannaCry kill switch domain
WannaCry checked a domain in its code, and the domain's activation functioned as a kill switch that stopped the malware from spreading.
Explicit Confidence 99% · Malwaretech EP 158 Details
“the domain was a kill switch”
“the malware stops everything it’s doing”
WannaCry kill switch domain DISCOVERED_BY Marcus Hutchins
Marcus Hutchins found the unregistered domain in the WannaCry code and registered it.
Explicit Direction flagged Confidence 99% · Malwaretech EP 158 Details
“When I saw this unregistered domain in the WannaCry code, I was like, nice”
“So, I registered it”
Kronos DEVELOPED_BY Marcus Hutchins
Marcus Hutchins says he wrote malware code that was combined with banking code to create the Kronos banking malware.
Explicit Confidence 96% · Malwaretech EP 158 Details
“I would write the malware for him and then he would sell it.”
“he had combined it with the banking malware”
rootkit DEVELOPED_BY Marcus Hutchins
Marcus Hutchins says he started as a malware writer specializing in rootkits.
Explicit Confidence 98% · Malwaretech EP 158 Details
“I started out as a malware writer. I specialized in writing rootkits.”
The prosecution's theory treated the malware as a keylogger because it listened to keystrokes; this is presented as the government's characterization rather than an uncontested technical classification.
Attributed Confidence 78% · Malwaretech EP 158 Details
“malware listens to keystrokes. Like, it’s like a key-logger”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:39:12.216151+00:00