Bulgarian Hacker “Emil Külev” Arrested and Detained – DataBreaches.Net

A 21-year-old Bulgarian man who called himself “Emil Külev” online was arrested by Sofia police.

A statement from the Bulgarian Prosecutor's Office said that Teodor Iliev was charged and detained for 72 hours for a number of computer crimes.

Between March 2020 and January 2024, Iliev allegedly illegally accessed the information systems of dozens of state institutions, commercial banks, insurance companies and other legal entities.

In July 2023, a BreachForums forum user calling himself “MAGADANS” leaked what he claimed to be the database of LEV INS, Bulgaria's largest insurance company. At the time, the company was owned by Alexei Petrov, who would be assassinated the following month.

“It's funny how quickly fate reaches people who unsuccessfully attempt assassination or kidnapping,” MAGADANS wrote. Without being more specific, the message ended with the message:

#МълчаниетоСвърши
#NiéSméSilata
#SubmissionOydva

Translation :
[#TheSilenceEnds
#WeAreThePower
#Retribution is Coming]

Less than 48 hours later, another new forum user added “MAGADANS.” DataBreaches is unsure if all the details are correct, but it identified “Emil Kulev” aka “MAGADANS” as Teodor Vanev Iliev. The redactions in the dox below are made by DataBreaches:

Emil Kulev (Емил Кюлев) aka MAGADANS – Теодор Ванев Илиев (Teodor Vanev Iliev)
Telephone: +[redacted]
ЕГН(ID): redacted]
Date of birth 07.02.2003 year.(Date of birth 02.07.2003)
Address : [redacted]

Find out another information about “Haker”.
Expect more information on this 19-year-old hacker. Smile

https://i.ibb.co/FWtQcLD/3.jpg
https://i.ibb.co/pX8YVvr/2.jpg
https://i.ibb.co/MBbYDY3/1.jpg

Besides Magadans, Külev was associated with the so-called State Agency for Digital Peace.

In September 2023, Questona provided more information about Külev's background and activities, highlighting similarities between Külev's methods and those of a new Bulgarian group, RansomedVC. RansomedVC confirmed that they were affiliated with Magadans.

Excerpt from a translation of the Sofia prosecutor's statement regarding Iliev's arrest:

The Sofia City Prosecutor's Office charged and detained for up to 72 hours 21-year-old Teodor Iliev in connection with repeated illegal actions (computer crimes) – unauthorized access to information systems of dozens of state institutions, commercial banks, insurance companies and other legal entities. copying and using relevant data from information tables, etc. It was established that unauthorized access to the databases was carried out between March 2020 and January 2024.

On June 28, 2024, as part of a preliminary investigation conducted under the supervision of the SGP, investigators of the Cybercrime Department of the National Investigation Service, together with employees of the Main Directorate for Combating Organized Crime of the Ministry of Internal Affairs, conducted investigative actions – searches and seizures, where more than 20 addresses on the territory of the country were checked. During the operation, Teodor III., presenting himself in the online space under the pseudonym “Emil Külev”, was found and arrested. During the operation, computer equipment was seized, including a personal laptop, which the detainee tried to destroy.

According to Theodore III, charges were brought under Art. 319a, para. 1; 319b, para. 2, as well as Art. 216, para. 3 of the Criminal Code.

The examination of the seized material is underway, and witness interviews have been carried out. Investigative actions into criminal activity continue.

A SGP prosecutor will ask the Sofia City Court to impose a pre-trial detention measure “pre-trial detention”.

At the time of publication, Iliev remained in detention.

“Acted alone”

Cybersecurity expert Yavor Kolev was quoted in Bulgarian media saying he knew hacker Emil Külev and acted alone:

“I know him, he acted alone. After speculations that he had penetrated the database of the insurance company Lev Ins, he hid abroad and stayed outside Bulgaria for a long time. Now that he is back, our authorities have arrested him. When you work in such a criminal enterprise, you exchange a lot of experience and skills with your colleagues and partners. He has no special education. As far as I know, he is absolutely self-taught,” Yavor Kolev said.