Marcus Hutchins, the 23-year-old security professional who accidentally stopped the spread of the virulent WCry ransomware worm in May, has been named in a federal indictment that alleges he was part of a conspiracy that created and distributed a piece of unrelated malware that steals banking credentials from unsuspecting computer users.

According to the eight-page indictment, the conspiracy involved Hutchins and one other person whose name still has not been made public. After Hutchins allegedly created the banking trojan dubbed "Kronos," a video circulated in July 2014 on a publicly available website that demonstrated how the malware worked. A month later, one of the unnamed co-conspirators put the malware up for sale at a price of $3,000. Hutchins and one of the co-conspirators allegedly updated Kronos around February 2015 and the co-conspirator sold it for $2,000 after advertising it on the Alphabay market.

A resident and citizen of the UK, Hutchins was charged with one count of conspiracy to commit computer fraud, three counts of distributing and advertising an electronic communication interception device, one count of endeavoring to intercept electronic communications, and one count of attempting to access a computer without authorization.

Hutchins was scheduled to be arraigned on Thursday afternoon in Las Vegas. He has not yet entered a plea, and attempts to seek comment from him were unsuccessful.

According to IBM security researchers, Kronos was also advertised in Russian underground crime forums, where the trojan listed for as much as $7,000. Like Gozi, Citadel, and other established banking trojans, the upstart malware was billed as a way for criminals to extract passwords and other financial credentials transmitted in major browsers. The ads also claimed Kronos could evade antivirus detection and protection from browser security sandboxes. A YouTube video, originally posted by an account calling itself Kronos Banking trojan, appears to be the demonstration video cited in the indictment. The video was removed shortly after this post went live. Mikko Hypponen, CTO of security firm F-Secure, reposted it shortly afterward.

Last November, according to researchers at Proofpoint Security, criminals were using malicious e-mail campaigns to infect companies in the hospitality, higher education, financial services, and healthcare industries with a new variant of Kronos. The malware would scour the memory of infected point-of-sale computers for credit card numbers and send them to a server controlled by the attackers.

Mystery solved

The indictment was unsealed about 24 hours after Hutchins was booked into the Henderson Detention Center in Nevada on Wednesday afternoon under unexplained circumstances that left many people in security circles suspicious. The arrest was initially confirmed by a screenshot that a friend of Hutchins captured of the facility website. When the friend visited the detention center on Thursday morning, he was told Hutchins was no longer there. The website mention of Hutchins was also gone. PJ Thomas, an administrator at the US Marshals office that the website referenced, said the agency has no record of Hutchins. The friend, citing privacy concerns, asked not to be identified by name in this article.

Hutchins spent the past week in Las Vegas as it hosted both the Black Hat and Defcon security gatherings. On late Wednesday morning, Hutchins and his friend parted ways as Hutchins left for the airport, where his Twitter account shows he tweeted over several hours. Then the account went silent—which the friend found odd, since Hutchins typically uses a plane's Wi-Fi service to stay in contact during flights. The first indication that something was seriously wrong was when the friend heard from Hutchins' mother early Thursday morning. She said Hutchins didn't arrive in the UK as planned.

"He's literally off the radar," the friend said. "I'm very concerned about that. I've known Marcus for years. I know everything about him, and I have no idea why he would be arrested."

Following the unsealing of the document, the friend told Ars he was "in shock." He added, "I had no idea. I don't think anyone did."

Hutchins is a researcher at security firm Kryptos Logic. On the morning of May 12, just as the WCry worm was starting to shut down computers around the globe, Hutchins started analyzing the code that made the self-replicating attack work. When he noticed that the code referenced an unregistered Internet domain, he impulsively registered it. He later learned that the Internet address acted as a kill switch that prevented ransomware infections on computers hit by the worm. Kryptos Logic estimates that as many as 727,000 computers may have been hit by the worm. The registration prevented the number from being much greater.

Ars Senior Business Editor Cyrus Farivar contributed to the reporting of this article. Post updated to correct the number of unnamed defendants.