Exposing the Bulgarian Cyber Army Cyber Threat Actor

Anonymous Bulgaria is your typical Anonymous “franchise” Anonymous hackers model where you have a group of people doing web site defacements and compromises of legitimate web sites and infrastructure and actually blame a bigger cause that they don’t really have anything to do with and don’t understand or know anything about it.

The ultimate goal here would be for the group to gain momentum including to attract followers where the ultimate goal would be to spread a message that they don’t often understand or have anything to do with low profile DDoS attacks or cyber attack attempts similar and typical to the Anonymous hackers collective idea.

Is it script kiddies or low profile wannabe hacker groups that basically have one social media account and are capable of launching low profile cyber attack attempts that often make the news or is it a bigger conspiracy where everyone doing the same can outsource their responsibility for doing it to the entire “idea” which basically represents an Anonymous set of people attempting to do low profile cyber attack attempts?

Let’s go for the first part.

The important part when dealing with this type of low profile threat actor is to usually keep track of their activities including social media profiles and activity and look for additional clues in terms of current and ongoing cyber attacks and most importantly look for additional clues such as personally identifiable information which would be later on used in a possible cyber threat actor attribution campaigns including for the actual enrichment of this PII for the purpose of looking for additional clues in terms of doing threat actor infrastructure reconnaissance on your way to look for additional clues such as related malicious and fraudulent including cybercrime activity including domains personally identifiable email address accounts or related social media accounts.

The ultimate goal when collecting these would be yo either build a database of the threat actor in question which could lead to a possible commercial or community driven project venture or to assist fellow researchers and Law Enforcement on its way go track down monitor and prosecute these individuals.

In this article I’ll discuss in-depth the Anonymous Bulgaria hacker franchise that basically just like many other Anonymous franchises across the globe basically represent low profile cyber attack attempts type of threat actors and will provide personally identifiable information on their online whereabouts.

Some of the other Bulgarian Web site defacement groups that are known to work and cooperate with Bulgarian Cyber Army include BG Worm, MTH Soft, Hack3D TeaM and EvilHack and Anonymous Bulgaria.

What’s specifically interesting about Bulgarian Cyber Army is that the group appears to be still and currently active and operational based on some of their latest web site defacement and Facebook activity.

Personally Identifiable Information on Bulgarian Cyber Army:

hxxp://facebook.com/hack3dteam

hxxp://vimeo.com/user16145338/videos

Personally Identifiable Information on Hack3d Team:

MaStErHaCk

Slackera

Tiger

RTFM

Sspdf11

PanteliX

Metalqear

MaStErChO

W!PS

TraferA

3ikmy

r00tkit

The Godfather

razora911

Personally Identifiable Information on EvilHack:

EvilHack[.]hmamail.com

anonyops[.]abv.bg

genadi_100[.]abv.bg

evil_hack[.]abv.bg

evilhack[.]bk.ru

evilhack000[.]gmail.com

clangrf[.]abv.bg

hxxp://anonymous-world.free.bg

hxxp://web-dangerous.free.bg

hxxp://evilhack-official.blogspot.com/

Personally Identifiable Information on Anonymous Bulgaria:

NoTolerance

Hades

PsychoPatternz

rootheR_

hxxp://anonbg.info