Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Marcus Hutchins
Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs
TL;DR The Gentlemen are a relatively new ransomware group who first emerged in July of 2025. In an incident investigated by Expel, the group used a zero-day vulnerability to disable the target’s EDR, preventing it from intervening in their ransomware attack. The threat actor relies heavily on bring-your-own-vulnerable-driver (BYOVD) style attacks to disable endpoint protection.
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
This research was also highlighted in WIRED. You can read the full article from Andy Greenberg and Matt Burgess here. TL;DR Expel is actively tracking an APT group that we assess with high confidence to be North Korean (DPRK) state-sponsored. We suspect that the threat actor is a subgroup or spin-off of a larger organization, potentially starting out as fraudulent IT workers before pivoting to malware.
the most warned about cyberattack to never exist.
🎥 Juice Jacking: the most warned about cyberattack to never exist. Why everyone from local news anchors to Fortune 500 CISOs are warning about a cyberattack that has never existed.
🔒 The Holiday Hangout Stream
This week doesn't exist, so come hangout, ask questions, talk tech & current events.
🔒 This Job Interview's "Take-Home Test" Is Malware
A detailed insight into a North Korean campaign targeted at hacking software engineers, how they sneak malware onto your system, and what you can do to protect yourself.
🔒 Holiday Hangout Stream
Ask questions, chat about current events, and just hang out
🔒 How North Korean Spies Are Hacking Developers via Job Interviews
🎥 How North Korean Spies Are Hacking Developers via Job Interviews A detailed insight into a North Korean campaign targeted at hacking software engineers, how they sneak malware onto your system, and what you can do to protect yourself.
🔒 MalwareTech Weekend Hangout
Ask questions, chat about current events, and just hang out
🔒 Do You Need To Worry About China's Agentic AI Cyberattacks?
🎥 Do You Need To Worry About China's Agentic AI Cyberattacks? Anthropic has just detected the first recorded fully AI automated cyberattack. Is this just hype or a real threat you should be concerned about? 00:00 Introduction 00:16 What The Report Claims 01:25 Debunking Hype & Misinformation 02:56 How They Automated Cyberattacks 05:02 Why Did They Need AI? 05:58 Why Did They Use US LLMs? 08:00 The Implications For Defenders
Cache smuggling: When a picture isn’t a thousand words
TL;DR We observed a recent campaign innovating on the ClickFix attack formula. This campaign leveraged cache smuggling, which avoids explicitly downloading any malicious files in an attempt to reduce detection. The lure in this campaign is designed to look like a VPN compliance checking tool. Editor’s note: Marcus Hutchins is now partnering with Expel as a contributor to our threat intelligence team.
Every Reason Why I Hate AI and You Should Too
Opinions Artificial Intelligence Technology One accusation that tends to get thrown my way often is being anti-innovation. If you’ve followed me for any amount of time, you’ve probably seen me dunking on everything from Cryptocurrency to Large Language Models. This often leads to people asking the question “why is someone so technical so anti-technology?”. To a lot of people on social media, I come of as just some unhinged weirdo who posts their every half-baked thought out onto the internet.
The US Needs A New Cybersecurity Strategy: More Offensive Cyber Operations Isn't It
Ever since China’s ‘Salt Typhoon’ hacking operations against US telecom networks was uncovered, there’s been a lot of discussion about “hacking back”. Now, what actually constitutes hacking back is somewhat of an enigma. Some believe that the US needs to do to China what they’re doing to us, whilst others think going further and launching offensive cyber operations against their infrastructure may serve as a deterrence. I’d like to share my thoughts on both.
Exploiting the Windows Kernel via Malicious IPv6 Packets (CVE-2024-38063)
Since the latest Windows patch dropped on the 13th of August I’ve been deep in the weeds of tcpip.sys (the kernel driver responsible for handling TCP/IP packets). A vulnerability with a 9.8 CVSS score in the most easily reachable part of the Windows kernel was something I simply couldn’t pass up on.
Bypassing EDRs With EDR-Preloading
Previously, I wrote an article detailing how system calls can be utilized to bypass user mode EDR hooks. Now, I want to introduce an alternative technique, “EDR-Preloading”, which involves running malicious code before the EDR’s DLL is loaded into the process, enabling us to prevent it from running at all. By neutralizing the EDR module, we can freely call functions normally without having to worry about user mode hooks, therefore do not need to rely on direct or indirect syscalls.
I Was Wrong About Mastodon
A few weeks ago, I made a tweet about how I thought Mastodon wouldn’t scale due to moderation issues. The tweet is since deleted (not because I deleted it individually, but because I later made the decision to purge my account and move to Mastodon). Mastodon is not a single social media platform, it is a federation. Think of it as a cross between email and Twitter. You can sign up for an email account with GMail, Yahoo, or Outlook.
TikTok is a National Security Risk, Not A Privacy One
Yesterday lawmakers introduced a bill to ban TikTok. But is an outright ban the right course of action, and what is the threat posed by TikTok? Much of the focus on TikTok has been primarily around user privacy, what data TikTok gathers, and what they do with it. I decided to investigate the extent of TikTok’s data collection, and came to the same conclusion as others. TikTok doesn’t operate outside the norms of standard social media apps, nor do they gather any data others don’t.
Everything you need to know about the OpenSSL 3.0.7 Patch
Live Status: this is an ongoing issue, and I plan to update this article when new information become available. Make sure to deep-refresh to avoid caching issues. Updates will also be post to my Twitter: @MalwareTechBlog Vulnerability Severity The full details of this vulnerability are not yet public. For that reason, it’s not possible to make any assertions about exploitability, attack surface, or risk.
Energy-Curable Coatings for Automotive Interiors: A More Suitable Alternative to 1K and 2K Coatings
By Marcus Hutchins, technical specialist, and Jennifer McClung, development chemist, allnex USA Introduction The words “driving experience” have grown to mean more to consumers than improved fuel economy, safety or drivability. Cars today are all about providing the driver with an interactive, customizable, luxury experience, requiring new technologies to meet the owner’s demands. Knobs, buttons and overhead lighting have been replaced by touchscreens, capacitive sensing and mood lighting.
Maine’s new income surtax for education is a step toward a prosperous society for all
Our Legislature is considering proposals to discard the 3 percent surtax on annual income over $200,000 that Maine voters approved in November. Rejecting the voters’ choice is a bad idea. Some have suggested that the tax will harm businesses, damage our economy, and turn away professionals who might move to Maine. These claims are simply not valid.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Marcus
Contact Marcus, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack