Malware researcher strangely disappears

[Jack]

Zero Day blogger and malware researcher Dancho Danchev (right) has gone missing since August last year and we have some troubling information that suggests he may have been harmed in his native Bulgaria.

Dancho, who was relentless in his pursuit of cyber-criminals, last blogged here on August 18. His personal blog has not been updated since September 11, 2010.

At ZDNet, we made multiple attempts to contact him, to no avail. Telephone numbers are going to Bulgarian language voicemails and our attempts to reach him via a snail mail address also came up empty.

Over the last few months, we have contacted the Bulgarian CERT authorities and used anti-virus contacts there to help us figure out Dancho’s disappearance. No one can figure out what happened to Dancho.

Last month, we finally got a mysterious message from a local source in Bulgaria that “Dancho’s alive but he’s in a lot of trouble.” We were told that he’s in the kind of trouble to keep him away from a computer and telephone, so it would be impossible to make contact with him.

Just recently, a trusted member of the malware research community reached out to us to say he had received a troubling letter from Dancho on September 9, 2010, about the threat of persecution in Bulgaria.

Here is Dancho’s letter:

[Name redacted],

As I consider you as a trusted colleague, and someone who understands the big picture of cyber crime and cyber espionage, I’m attaching you photos of the “current situation in my bathroom”, courtesy of Bulgarian Law enforcement+intell services who’ve been building a case trying to damage my reputation, for 1.5 years due to my clear pro-Western views+the fact that a few months ago, the FBI Attache in Sofia, Bulgaria recommended me as an expert to Bulgarian CERT -> clearly you can see how they say “You’re Welcome”.

I’m sending you these not with the idea to see them published, but as an insurance in case things get ugly, knowing that a trusted third-party has access to these and can always distribute them to [redacted] mailing list members, and pretty much the entire industry, especially the press.


The LEO behind the whole operation: [ NAME REDACTED ]

I’m in a process of contacting journalists -> just in case.

I hope you’re the trusted industry contact that I think you are, and you’ll basically keep these somewhere safe. Thank you, and please use my PGP key.


Best regard

Read more