Neel Mehta

Background

Neel Mehta is a computer security researcher who has worked on Google's security team, where he has focused on vulnerability research and threat analysis. He became widely known in the information security community for two separate discoveries roughly three years apart: the Heartbleed vulnerability in OpenSSL in 2014, and a code-level link between the WannaCry ransomware and the Lazarus Group in 2017.

Discovery of Heartbleed

In early 2014, Mehta discovered a serious memory-handling flaw in OpenSSL's implementation of the TLS/DTLS heartbeat extension, later named Heartbleed. The bug allowed an attacker to read up to 64 kilobytes of a server's memory per request, potentially exposing private keys, session tokens, passwords, and other sensitive data without leaving a trace in server logs. According to OpenSSL developer Mark J. Cox, Mehta privately reported the flaw to the OpenSSL team on April 1, 2014. The Finnish security firm Codenomicon, working independently, discovered the same bug at approximately the same time while testing its own software; Codenomicon's researchers also named the vulnerability and created the widely circulated "Heartbleed" logo used to publicize it. Because Google's report reached OpenSSL first, Mehta is generally credited as the original discoverer, with Codenomicon's team credited as independent co-discoverers.

The vulnerability was publicly disclosed on April 7, 2014, coordinated with the release of a patched OpenSSL version. The disclosure triggered a large-scale, urgent effort across the technology industry to patch servers, revoke and reissue TLS certificates, and reset user credentials, since an unknown number of servers could have been silently exploited before the fix. Mehta received a $15,000 award from the Internet Bug Bounty program for his responsible disclosure of the flaw, which he donated to a fundraiser for the Freedom of the Press Foundation.

Linking WannaCry to the Lazarus Group

On May 15, 2017, in the midst of the global WannaCry ransomware outbreak that had affected roughly 200,000 computers across more than 150 countries, Mehta posted a brief message on Twitter containing cryptographic hashes for two malware samples along with specific offsets where portions of their code were identical, tagged with the hashtag "#WannaCryptAttribution." He offered no further commentary. Security researchers, including the team at Kaspersky Lab, quickly determined that the tweet identified overlapping code between an early, rare February 2017 version of the WannaCry cryptor and a February 2015 malware sample previously attributed to the Lazarus Group, a threat actor publicly linked to North Korea and associated with earlier attacks such as the 2014 Sony Pictures breach and the 2016 Bangladesh Bank heist.

Kaspersky researchers described Mehta's finding as "the most significant clue to date regarding the origins of WannaCry," and other firms, including Symantec, corroborated the code overlap in their own analyses. Researchers cautioned that shared code alone does not constitute definitive proof of attribution, since code can be reused, purchased, or planted by unrelated actors, but the discovery substantially shaped subsequent public and governmental attribution of WannaCry to North Korean state-sponsored hackers.

Significance and legacy

Mehta's two discoveries are frequently cited as examples of how individual researchers, often working with minimal public fanfare, can have an outsized effect on global security response. The Heartbleed disclosure remains one of the most cited case studies in coordinated vulnerability disclosure and prompted lasting changes in how the industry handles critical cryptographic library flaws. His WannaCry tweet is likewise cited as a formative moment in public malware attribution, illustrating both the value and the limits of code-similarity analysis as attribution evidence.

Timeline

• 2014-04-01Neel Mehta privately reports the Heartbleed vulnerability in OpenSSL to the OpenSSL security team.
• 2014-04-07Heartbleed is publicly disclosed alongside a patched OpenSSL release, prompting mass patching and certificate reissuance across the internet.
• 2017-05-15Mehta tweets malware hashes and matching code offsets under the hashtag #WannaCryptAttribution, revealing code shared between an early WannaCry sample and a Lazarus Group backdoor from February 2015.