The Miracle of MalwareTech's Domain

The wonder

On the afternoon of 12 May 2017, as WannaCry raged, 22-year-old researcher Marcus Hutchins, known as MalwareTech, noticed that the worm queried an unregistered domain and registered it for about $10.69, intending to track the infection. Without knowing it, he triggered the worm's built-in kill switch: new copies, finding the domain live, stopped spreading. Over the following days he and colleagues kept the sinkhole online under botnet DDoS attacks.

The miracle worker

Marcus Hutchins (MalwareTech), with Proofpoint's Darien Huss, who independently spotted and confirmed the kill switch, and the researchers who defended the sinkhole in the days that followed.

Thanksgiving

For ten dollars well spent, for the curiosity of someone who registers a strange domain, and for those who kept the sinkhole running, we give thanks. Amen.

Technical record

While analysing WannaCry samples on the day of the outbreak, 22-year-old researcher Marcus Hutchins (MalwareTech) noticed the worm queried an unregistered domain and registered it for about $10.69. That accidentally triggered the worm's built-in kill switch and stopped new infections from spreading. He and colleagues then kept the sinkhole online under botnet DDoS attacks.