Exposing BG Worm - A Bulgaria-Based Web Site Defacement Group - An OSINT Analysis

An image is worth a thousand words.

EvilHack -> http://www.youtube.com/user/AnonymousEvilHack/about -> http://cyber-code.tk/ -> BG Cyber Army -> http://www.zone-h.org/archive/notifier=Bulgarian%20Cyber%20Army 

-> https://www.facebook.com/bgcyberarmy

Bca-group.org - Email: bca-group@mail.ru

BG Cyber Army - Cyber Root, Cyber King, iNCUBUS, JoKeR, MoonSpire

- [Pa3pyxA, FuckOFF, CyberKing, CyberLord]

CyberLord: cyberlordbg@mail.ru :: [OK]

[+] CyberKing: z3roc00l@mail.ru :: [OK]

Pa3pyxA: ra3pyxa@mail.ru

Anonymous BG's main forum URL: http://anonbg.info

Group member handles: rootheR_, Hades, NoTolerance, EvilHack, PsychoPatternz.

Forum postings for ID-ed member PsychoPatternz: http://anonbg.info/member.php?34-PsychoPatternz

Forum postings for ID-ed member EvilHack: http://anonbg.info/member.php?13-EvilHack

EvilHack's real name: Genadi

Skype: genadi_97

Skype: anonymous_evilhack

City: Veliko Turnovo or Tutrakan

Associated emails:

clangrf@abv.bg

genadi_100@abv.bg

anonyops@abv.bg

EvilHack@hmamail.com

evilhack000@gmail.com

evilhack@bk.ru

evil_hack@abv.bg

URL he maintains:

https://www.facebook.com/pages/EvilHack-Programs

http://anonymous-world.free.bg/page-8.html

http://web-dangerous.free.bg/page-9.html

http://evilhack-official.blogspot.com/

http://www.podariavam.com/user/GenadiD

PsychoPatternz's name: Asparuh Naydenov

City:: Plovdiv

Skype: asparuh1231

URLs he maintains:

http://psychopatternz.blogspot.com/

https://www.facebook.com/hakhz/timeline

Facebook profile:

https://www.facebook.com/Psychopatternz

EvilHack appears to be also a member of a newly emerged group, namely, Bulgarian Cyber Army.

Connection: EvilHack -> http://www.youtube.com/user/AnonymousEvilHack/about -> http://cyber-code.tk/ -> BG Cyber Army -> http://www.zone-h.org/archive/notifier=Bulgarian%20Cyber%20Army

-> https://www.facebook.com/bgcyberarmy

Official Web site: bca-group.org - Email: bca-group@mail.ru

Related group emails: bca-group@bk.ru; adrenalinovocs@abv.bg

Current members: Cyber Root, Cyber King, iNCUBUS, JoKeR, MoonSpire

Ex-members: Pa3pyxA, FuckOFF, CyberKing, CyberLord

Group members' associated emails:

CyberLord - cyberlordbg@mail.ru

CyberKing - z3roc00l@mail.ru

Pa3pyxA - ra3pyxa@mail.ru

Group's Name: Hack3D TeaM" or "MTH Soft

Facebook: https://www.facebook.com/hack3dteam;

https://www.facebook.com/bgworm.info

Vimeo account: http://vimeo.com/user16145338/videos

Forum: http://hakerstvo.informe.com/

Zone-H Archive: http://zone-h.org/archive/notifier=MaStErChO/page=1

Hackdb Archive: http://www.hack-db.com/hacker/r00tkit/all.html

Google Plus Profile: https://plus.google.com/104878573752624522053/photos

Group Members: r00tkit, MaStErChO AloneWolf, Sspdf11, razora911, Metalqear

Shout outs most commonly given to -- on the basis of multiple defaced

page assessments --MaStErHaCk, - RTFM -The Godfather-(tm)(R) PanteliX (R)(tm) -

(tm)W!PS(tm) - Tiger(tm) - Slackera - TraferA - 3ikmy - N3x0R.

Known group domains' reconnaissance:

hxxp://bgworm.com - Email: gudolik@gmail.com -  name: "Mastercho

Hoomie" same as the Google Plus account

hxxp://bgworm.info - historical WHOIS emails: Email: nikolas47@abv.bg;

Email: mahon-74@hotmail.com

Group member profile: Anton Nikolaev (MaStErChO)

Email: ludoto_93@abv.bg - email used from the forum's registration confirmation

Secondary email: ludoto_93@hotmail.com - Reference:

https://www.facebook.com/photo.php?fbid=327560933969442&set=a.325721410820061.74800.125466524178885&type=1

Skype: ko.ti.puka

Mobile: 0895373102

Second Mobile: 0887565357

Birth date: March 25, 1992 or 17 July, 1990

Stay tuned!