Professional Documents
Culture Documents
Plaintiff,
MARCUS HUTCHINS,
Defendant.
PLEA AGREEMENT
United States Attorney for the Eastern District of Wisconsin, and Benjamin Proctor
and Benjamin Taibleson, Assistant United States Attorneys, and the defendant,
Marcus Hutchins, individually and by attorneys Brian Klein, Marcia Hofmann, and
CHARGES
indictment, which allege violations of Title 18, United States Code, Sections 2; 371;
3. The defendant has read and fully understands the charges contained
in the indictment. He fully understands the nature and elements of the crimes with
fact, guilty of the offenses described in paragraph 4. The parties acknowledge and
understand that if this case were to proceed to trial, the government would be able
to prove the facts in Attachment A, as well as the facts set forth in Counts One and
admits that these facts are true and correct and establish his guilt beyond a
setting forth a factual basis for the plea of guilty. It is not a full recitation of the
PENALTIES
6. The parties understand and agree that the offenses to which the
defendant will enter a plea of guilty carry the following maximum terms of
discussed the relevant statutes as well as the applicable sentencing guidelines with
his attorneys.
time of sentencing.
ELEMENTS
18 U.S.C. § 371 as set forth in Count One, the government must prove each of the
2. The defendant knowingly became a member of the conspiracy with the intent
to advance the conspiracy; and
U.S.C. § 2512(1)0(0 as set forth in Count Two, the government must prove each of
2. The defendant knew or had reason to know that the design of the device
renders it primarily useful for the purpose of the surreptitious interception of
wire, oral, or electronic communication;
3. The defendant knew or had reason to know that the advertisement would be
transported in interstate or foreign commerce.
10. The parties agree to waive the time limits in Fed. R. Crim. P. 32
disclosed not less than 35 days before the sentencing hearing, in favor of a schedule
for disclosure, and the filing of any objections, to be established by the court at the
11. The parties acknowledge, understand, and agree that any sentence
imposed by the court will be pursuant to the Sentencing Reform Act, and that the
court will give due regard to the Sentencing Guidelines when sentencing the
defendant.
12. The parties acknowledge and understand that prior to sentencing the
United States Probation Office will conduct its own investigation of the defendant's
criminal history. The parties further acknowledge and understand that, at the time
the defendant enters a guilty plea, the parties may not have full and complete
understand, and agree that the defendant may not move to withdraw the guilty plea
history.
be sentenced within any particular sentence range, and that the court may impose a
reasonable sentence above or below the guideline range. The parties further
4
inaccurate information that affects the calculations, the government is not bound to
Relevant Conduct
consider relevant conduct in calculating the sentencing guidelines range, even if the
relevant conduct is not the subject of the offenses to which the defendant is pleading
guilty,
15. The parties agree to recommend the following base offense levels and
the guidelines are to be calculated for each offense that is subject of the
For Count Two: a base offense level of 6 under § 2113.2(a) and a 3-level
increase for commission of the offense for pecuniary gain under § 2113.2(b).
Acceptance of Responsibility
addition, if the court determines at the time of sentencing that the defendant is
entitled to the two-level reduction under § 3E1.1(a), the government agrees to make
Sentencing Recommendations
17. Both parties reserve the right to provide the district court and the
probation office with any and all information which might be pertinent to the
sentencing process, including but not limited to any and all conduct related to the
offense as well as any and all matters which might constitute aggravating or
any and all factors pertinent to the determination of the sentencing guideline range;
the fine to be imposed; the amount of restitution and the terms and condition of its
payment; the length of supervised release and the terms and conditions of the
release; the defendant's custodial status pending the sentencing; and any other
position with respect to any fact or factor pertinent to the sentencing decision
consistent with this agreement and to advise the court that the government's failure
20. The parties acknowledge, understand, and agree that neither the
sentencing court nor the United States Probation Office is a party to or bound by
this agreement. The United States Probation Office will make its own
recommendations to the sentencing court. The sentencing court will make its own
determinations regarding any and all issues relating to the imposition of sentence
and may impose any sentence authorized by law up to the maximum penalties set
forth in paragraph 6 above. The parties further understand that the sentencing
court will be guided by the sentencing guidelines but will not be bound by the
sentencing guidelines and may impose a reasonable sentence above or below the
may not move to withdraw the guilty plea solely as a result of the sentence imposed
by the court.
FINANCIAL MATTERS
22. The defendant acknowledges and understands that any and all
financial obligations imposed by the sentencing court are due and payable in full
upon entry of the judgment of conviction. The defendant further understands that
any payment schedule imposed by the sentencing court shall be the minimum, the
defendant is expected to pay and that the government's collection of any and all
court imposed financial obligations is not limited to the payment schedule. The
defendant agrees not to request any delay or stay in payment of any and all
schedule of payments.
(FLU) of the United States Attorney's Office upon request of the FLU during any
Special Assessment
24. The defendant agrees to pay the special assessment in the amount of
understands that he surrenders any claims he may have raised in any pretrial
c. If the trial is held by the judge without a jury, the judge would find
the facts and determine, after hearing all of the evidence, whether
or not he was persuaded of defendant's guilt beyond a reasonable
doubt.
he is waiving all the rights set forth above. The defendant further acknowledges the
fact that his attorney has explained these rights to him and the consequences of his
waiver of these rights. The defendant further acknowledges that as a part of the
guilty plea hearing, the court may question the defendant under oath, on the record,
and in the presence of counsel about the offense to which the defendant intends to
plead guilty. The defendant further understands that the defendant's answers may
later be used against the defendant in a prosecution for perjury or false statement.
adjudicated guilty of the offenses to which he will plead guilty and thereby may be
deprived of certain rights, including but not limited to the right to vote, to hold
28. The defendant knowingly and voluntarily waives all claims he may
have based upon the statute of limitations, the Speedy Trial Act, and the speedy
trial provisions of the Sixth Amendment. The defendant agrees that any delay
between the filing of this agreement and the entry of the defendant's guilty plea
pursuant to this agreement constitutes excludable time under the Speedy Trial Act.
defendant knowingly and voluntarily waives his right to appeal his conviction or
sentence in this case and further waives his right to challenge his conviction or
pursuant to 28 U.S.C. § 2255. As used in this paragraph, the term "sentence" means
10
release condition, fine, forfeiture order, and restitution order. The defendant's
waiver of appeal and post-conviction challenges includes the waiver of any claim
that (1) the statutes or Sentencing Guidelines under which the defendant is
convicted or sentenced are unconstitutional, and (2) the conduct to which the
defendant has admitted does not fall within the scope of the statutes or Sentencing
based on (1) any punishment in excess of the statutory maximum, (2) the sentencing
or sex, (3) ineffective assistance of counsel in connection with the negotiation of the
plea agreement or sentencing, or (4) a claim that the plea agreement was entered
involuntarily.
defendant has discussed with his attorney and understands that nothing contained
in this agreement, including any attachment, is meant to limit the rights and
authority of the United States of America or any other state or local government to
including but not limited to any listing and debarment proceedings to restrict rights
and opportunities of the defendant to contract with or receive assistance, loans, and
11
31. The defendant recognizes that pleading guilty may have consequences
with respect to the defendant's immigration status if the defendant is not a citizen
of the United States. Under federal law, a broad range of crimes are removable
and other immigration consequences are the subject of a separate proceeding, and
the defendant understands that no one, including the defendant's attorney or the
sentencing court, can predict to a certainty the effect of the defendant's conviction
on the defendant's immigration status. The defendant nevertheless affirms that the
including the potential for automatic removal from the United States.
GENERAL MATTERS
32. The parties acknowledge, understand, and agree that this agreement
does not require the government to take, or not to take, any particular position in
33. The parties acknowledge, understand, and agree that the United
States Attorney's office is free to notify any local, state, or federal agency of the
defendant's conviction.
34. The defendant understands that pursuant to the Victim and Witness
Protection Act, the Justice for All Act, and regulations promulgated thereto by the
Attorney General of the United States, the victim of a crime may make a statement
describing the impact of the offense on the victim and further may make a
of this agreement at any time, engages in any further criminal activity prior to
sentencing, or fails to appear for sentencing, this agreement shall become null and
void at the discretion of the government. The defendant further acknowledges and
upon final resolution of this matter. If this plea agreement is revoked or if the
right to reinstate any and all dismissed charges and to file any and all charges
which were not filed because of this agreement. The defendant hereby knowingly
and voluntarily waives any defense based on the applicable statute of limitations for
any charges filed against the defendant as a result of his breach of this agreement.
The defendant understands, however, that the government may elect to proceed
with the guilty plea and sentencing. If the defendant and his attorney have signed a
proffer letter in connection with this case, then the defendant further acknowledges
and understands that he continues to be subject to the terms of the proffer letter.
plead guilty freely and voluntarily because he is in fact guilty. The defendant
13
14
Date:
BRIAN KLEIN
Attorney for Defendant
Date: 4/15/2019
MARCIA H FMANN
Attorney for Defendant
fe-r-
Date: 4--eIn ill
DANIEL STILLER
Attorney for Defendant
Date: gi/ 4 it `‘
MATTHEW D. KRU ER
United States Attorn
Date: cii
BENJAMIN PROCTOR
Assistant United States Attorney
Date:
BENJAMIN TAIBLESON
Assistant United States Attorney
15
Between July 2012 and September 2016, Marcus Hutchins helped create and,
in partnership with another, sell malicious computer code, a/k/a malware, known as
UPAS-Kit and Kronos,' During this time, Hutchins used aliases such as
"Malwaretech" and "irp@jabber.se." One of Hutchins' partners, who went by aliases
including "Vinny," "VinnyK," and "Aurora123," advertised and sold the malware.
Hutchins and "Vinny" agreed to share the profits from the sales of the malware, and
they sought to maximize their profits by selling the malware to as many people as
possible. Hutchins also personally provided Kronos to an individual in California
who, as Hutchins knew, was active in using malware to gain unlawful access to
computers and victims' personal information. Hutchins worked hard to conceal his
role in the development and distribution of the malware. At the relevant time,
Hutchins resided in the United Kingdom.
UPAS and Kronos are similar types of malware that utilize, among other
things, form grabbers, key loggers, and web injects to intercept communications and
collect personal information, including usernaraes, passwords, email addresses, and
financial data, from any number of victim computers. The information from the
infected victim computers would then be relayed to the person running the control
panel for the malware program. The malware concealed itself in legitimate
programs already running on a victim computer, and the malware was configured to
avoid anti-virus programs. The malware was designed to target banking
information and to work on many types of web browsers, including Internet
Explorer, Firefox, and Chrome. Installation of UPAS or Kronos on a computer
removes, replaces, and modifies space and information on that computer thereby
impairing the integrity and availability of data, a program, a system, and
information on the computer. Since 2014, Kronos has been used to infect numerous
computers around the world and steal banking information. This includes causing
damage to 10 or more protected computers within a 1-year period.
i Terms such as "Kronos," "UPAS Kit," "malware," "crypting," "protected computer," and
"form grabber" are all defined in the Superseding Indictment, which is incorporated into this
factual summary.
k, On June 11, 2015, Vinny sold Kronos for $2,000 in WebMon.ey to CS2,
who was in the Eastern District of Wisconsin. After the transfer of funds was
1. On or about July 17, 2016, Vinny contacted CS2 asking if Kronos was
working fine and whether CS2 needed any crypting services for Kronos.
In December 2014, Hutchins told CS3 that he (Hutchins) needs to keep a low
profile and that he hoped no one else knew he coded Kronos. Hutchins told 0S3 that
CS has "gotta be careful who you share with though, unless you're confident that if
these people turn fed and decide to rattle you for info on me, you won't say shit[.]"
Hutchins mentioned that Kronos sales were still slow, noting that the reason "could
just be that the bot hasn't got the attention yet." Hutchins said that "people want
the vile before considering" purchasing Kronos. Hutchins went on to say that Vinny
told him sales of Kronos will improve with the vnc.
In January 2015, Hutchins again complained to 0S3 about the lack of sales of
Kronos. Later, Hutchins said that "Vinny brought some good news today . .
apparently someone posted a review and loads of people added him," referring to a
good review of Kronos that led many people to contact Vinny regarding Kronos. Also
in January 2015, C83 and Hutchins discussed seeing another person selling
"cracked bins" of Kronos (a cracked version of Kronos) on an internet forum.
Hutchins said that "if he actually cracked it [Kronosl, there's a little surprise for
everyone who uses the cracked bins. . . . [T]here's a 'bug' in the rootkit, where it may
after some time accidently delete the bot file from the computer."
In February 2015, Hutchins told CS3 that he "made a few fixes" to Kronos,
and that he was motivated to update Kronos because sales of Kronos had picked up
In May 2015, Hutchins told CS3 that due to a manufacturer's update to the
Chrome web browser, the Kronos formgrabber stopped working. Hutchins noted
that if sales of Kronos were good, Vinny would be pressing Hutchins to fix the
problem.
In June 2015, Hutchins told 0S3 that Vinny was trying to hire another coder
to update Kronos. Hutchins said that this could get Hutchins in trouble because
Hutchins knew the person Vinny wanted to hire, and that person would likely
recognize that Hutchins developed the code for Kronos. Hutchins then concluded
that sales of Kronos "aint going anywhere without me" because Vinny needs
Hutchins' skills to update Kronos and add the vnc, which no one else can do.
Hutchins was arrested August 2, 2017. Following his arrest, Hutchins was
advised of his Miranda rights orally and in writing, and he was advised that it was
a crime to lie to FBI agents. In a post-arrest statement, Hutchins admitted to
dealing with "Vinny," including being paid by Vinny for developing code for UPAS
and Kronos, which Vinny then sold.