Exposing Bulgarian Cyber Army Hacking Group - An OSINT Analysis

In this OSINT analysis I'll offer in-depth information and analysis of Bulgaria's Bulgarian Cyber Army including personally identifiable information on some of the key members behind the group for the purpose of assisting U.S Law Enforcement and the U.S Intelligence Community on its way to track down and prosecute the cybercriminals behind these campaigns.

EvilHack -> http://www.youtube.com/user/AnonymousEvilHack/about -> http://cyber-code.tk/ -> BG Cyber Army -> http://www.zone-h.org/archive/notifier=Bulgarian%20Cyber%20Army 

-> https://www.facebook.com/bgcyberarmy

Bca-group.org - Email: bca-group@mail.ru

BG Cyber Army - Cyber Root, Cyber King, iNCUBUS, JoKeR, MoonSpire

- [Pa3pyxA, FuckOFF, CyberKing, CyberLord]

CyberLord: cyberlordbg@mail.ru :: [OK]

[+] CyberKing: z3roc00l@mail.ru :: [OK]

Pa3pyxA: ra3pyxa@mail.ru

Anonymous BG's main forum URL: http://anonbg.info

Group member handles: rootheR_, Hades, NoTolerance, EvilHack, PsychoPatternz.

Forum postings for ID-ed member PsychoPatternz: http://anonbg.info/member.php?34-PsychoPatternz

Forum postings for ID-ed member EvilHack: http://anonbg.info/member.php?13-EvilHack

EvilHack's real name: Genadi

Skype: genadi_97

Skype: anonymous_evilhack

City: Veliko Turnovo or Tutrakan

Associated emails:

clangrf@abv.bg

genadi_100@abv.bg

anonyops@abv.bg

EvilHack@hmamail.com

evilhack000@gmail.com

evilhack@bk.ru

evil_hack@abv.bg

URL he maintains:

https://www.facebook.com/pages/EvilHack-Programs

http://anonymous-world.free.bg/page-8.html

http://web-dangerous.free.bg/page-9.html

http://evilhack-official.blogspot.com/

http://www.podariavam.com/user/GenadiD

PsychoPatternz's name: Asparuh Naydenov

City:: Plovdiv

Skype: asparuh1231

URLs he maintains:

http://psychopatternz.blogspot.com/

https://www.facebook.com/hakhz/timeline

Facebook profile:

https://www.facebook.com/Psychopatternz

EvilHack appears to be also a member of a newly emerged group, namely, Bulgarian Cyber Army.

Connection: EvilHack -> http://www.youtube.com/user/AnonymousEvilHack/about -> http://cyber-code.tk/ -> BG Cyber Army -> http://www.zone-h.org/archive/notifier=Bulgarian%20Cyber%20Army

-> https://www.facebook.com/bgcyberarmy

Official Web site: bca-group.org - Email: bca-group@mail.ru

Related group emails: bca-group@bk.ru; adrenalinovocs@abv.bg

Current members: Cyber Root, Cyber King, iNCUBUS, JoKeR, MoonSpire

Ex-members: Pa3pyxA, FuckOFF, CyberKing, CyberLord

Group members' associated emails:

CyberLord - cyberlordbg@mail.ru

CyberKing - z3roc00l@mail.ru

Pa3pyxA - ra3pyxa@mail.ru

Group's Name: Hack3D TeaM" or "MTH Soft

Facebook: https://www.facebook.com/hack3dteam;

https://www.facebook.com/bgworm.info

Vimeo account: http://vimeo.com/user16145338/videos

Forum: http://hakerstvo.informe.com/

Zone-H Archive: http://zone-h.org/archive/notifier=MaStErChO/page=1

Hackdb Archive: http://www.hack-db.com/hacker/r00tkit/all.html

Google Plus Profile: https://plus.google.com/104878573752624522053/photos

Group Members: r00tkit, MaStErChO AloneWolf, Sspdf11, razora911, Metalqear

Shout outs most commonly given to -- on the basis of multiple defaced

page assessments --MaStErHaCk, - RTFM -The Godfather-(tm)(R) PanteliX (R)(tm) -

(tm)W!PS(tm) - Tiger(tm) - Slackera - TraferA - 3ikmy - N3x0R.

Known group domains' reconnaissance:

hxxp://bgworm.com - Email: gudolik@gmail.com -  name: "Mastercho

Hoomie" same as the Google Plus account

hxxp://bgworm.info - historical WHOIS emails: Email: nikolas47@abv.bg;

Email: mahon-74@hotmail.com

Group member profile: Anton Nikolaev (MaStErChO)

Email: ludoto_93@abv.bg - email used from the forum's registration confirmation

Secondary email: ludoto_93@hotmail.com - Reference:

https://www.facebook.com/photo.php?fbid=327560933969442&set=a.325721410820061.74800.125466524178885&type=1

Skype: ko.ti.puka

Mobile: 0895373102

Second Mobile: 0887565357

Birth date: March 25, 1992 or 17 July, 1990

Sample Personal Photos of Bulgarian Cyber Army Team Members:

 

Stay tuned!