We need help with the strange disappearance of Dancho Danchev

We need help with the strange disappearance of Dancho Danchev

Summary: Zero Day blogger and malware researcher Dancho Danchev has gone missing since August last year and we have some troubling information that suggests he may have been harmed in his native Bulgaria.

SHARE:
TOPICS: Browser
101

Update: After a lot of help from folks, Dancho has resurfaced in a tweet received on Jan 21. We're not going into details---so he can explain, but here's the tweet.

The original post follows:

Zero Day blogger and malware researcher Dancho Danchev (right) has gone missing since August last year and we have some troubling information that suggests he may have been harmed in his native Bulgaria.

Dancho, who was relentless in his pursuit of cyber-criminals, last blogged here on August 18.  His personal blog has not been updated since September 11, 2010.

At ZDNet, we made multiple attempts to contact him, to no avail.  Telephone numbers are going to Bulgarian language voicemails and our attempts to reach him via a snail mail address also came up empty.

Over the last few months, we have contacted the Bulgarian CERT authorities and used anti-virus contacts there to help us figure out Dancho's disappearance. No one can figure out what happened to Dancho.

Last month, we finally got a mysterious message from a local source in Bulgaria that "Dancho's alive but he's in a lot of trouble." We were told that he's in the kind of trouble to keep him away from a computer and telephone, so it would be impossible to make contact with him.

Just recently,  a trusted member of the malware research community reached out to us to say he had received a troubling letter from Dancho on September 9, 2010, about the threat of persecution in Bulgaria.

Here is Dancho's letter:

[Name redacted],

As I consider you as a trusted colleague, and someone who understands the big picture of cyber crime and cyber espionage, I'm attaching you photos of the "current situation in my bathroom", courtesy of Bulgarian Law enforcement+intell services who've been building a case trying to damage my reputation, for 1.5 years due to my clear pro-Western views+the fact that a few months ago, the FBI Attache in Sofia, Bulgaria recommended me as an expert to Bulgarian CERT -> clearly you can see how they say "You're Welcome".

I'm sending you these not with the idea to see them published, but as an insurance in case things get ugly, knowing that a trusted third-party has access to these and can always distribute them to [redacted] mailing list members, and pretty much the entire industry, especially the press.

The LEO behind the whole operation: [ NAME REDACTED ]

I'm in a process of contacting journalists -> just in case.

I hope you're the trusted industry contact that I think you are, and you'll basically keep these somewhere safe. Thank you, and please use my PGP key.

Best regards

Alongside the letter, Dancho attached several photographs on what appears to some sort of bugging device and wires coming out of walls in his apartment:

We are unsure about how to proceed and decided to publish this information in the hope that someone in the know can help shed some light on Dancho's disappearance.

If you have any information on his whereabouts or can help point us in the right direction, please don't hesitate to contact us.

Topic: Browser

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

101 comments
Log in or register to join the discussion
  • Looks like...

    Looks like a fluorescent light transformer and fixture to me. A shoddy installation, US electrical code would not allow the use of tape like that. Could be acceptable practice in Bulgaria.

    Which is not to say that I don't think the situation is serious.
    marshray
    • Tough to figure out. From what I can see, it looks odd

      @marshray <br>It looks like Romex coming in from the left, then down through the shelf ( to the transformer?), and next to that a black and blue (I believe brown and blue are used in Europe as opposed to Black and white used here in the US) comming back up thru the shelf (from the transformer) to distribution connectors, then out to the lights.<br><br>The blue wires don't look to be any part of the circuit at all. They're taped to some (differently?) marked white wires then out of view to the left.<br><br>It could be that the picture is about the blue wires thru the wall, the others wires just happen to be the pre-existing LED light hook-up that happen to be in the picture as thats where they were?
      John Zern
  • RE: We need help with the strange disappearance of Dancho Danchev

    When talking time lines, you should also include his twitter account was updated Oct 20th
    john123@...
    • RE: We need help with the strange disappearance of Dancho Danchev

      [deleted]
      ekcarp
  • RE: We need help with the strange disappearance of Dancho Danchev

    Actually it is a low voltage transformer for dimmable halogen lighting that hadn't been finished yet. I'd hope the tape was temporary until the fixtures were hooked up.

    Agree it doesn't seem to be a bugging device and probably has nothing to do with him being missing.
    slewis1
    • RE: We need help with the strange disappearance of Dancho Danchev

      @slewis@... Just because what you see is the shell of a low-voltage xformer doesn't mean that's what it is. Why would he take a photo of something he was installing and pass it off as evidence of foul play? Obviously it wasn't supposed to be there and the shell could have housed anything.
      kenaaa2
      • Why would such a disguise be extended to show...

        @ken@... the worrisome wiring? A simple wall-wart box would draw much less attention. Bugs aren't that hard to hide. I've done it for law enforcement.

        And how long has Danchev been in this house? The wiring could easily pre-date him.
        Papa_Bill
      • RE: We need help with the strange disappearance of Dancho Danchev

        @ken@... So they have installed a bathroom mirror, a shelf, some light fixtures, and a transformer, all for disguising a bug. Please ...
        bumv2
    • RE: We need help with the strange disappearance of Dancho Danchev

      @slewis@... That could be anything in there. But then, its also possible he's had some kind of breakdown.
      Possibly triggered by the stress of actually being watched or threats from the criminal community.

      I think I speak for all of us when I say that if you' re reading this Dancho, I wish you the best of luck with whatever is troubling you. Hope you're ok and back blogging soon.
      SiO2
      • RE: We need help with the strange disappearance of Dancho Danchev

        @HexHammer67 You and I had guessed it right :( (among others which I didn't notice of course) you were the first (on 14th of January) and I totally agree with your comment:

        "I think I speak for all of us when I say that if you' re reading this Dancho, I wish you the best of luck with whatever is troubling you. Hope you're ok and back blogging soon."

        But I'd go for a change of field :) security related issues are enough don't you agree? :) there are dozens of computer related wonderful topics to blog on!
        armensar99
  • RE: We need help with the strange disappearance of Dancho Danchev

    Those are the pictures he sent. We decided to publish everything we have to put it all out there.

    _ryan
    Ryan Naraine
    • RE: We need help with the strange disappearance of Dancho Danchev

      @Ryan Naraine

      May I suggest Interpol or if he is a U.S. citizen try contacting the U.S. Embassy or Consulate. I would recommend sending the photos and any electronic data you have to them. Perhaps they can help, I don't know but it may be worth a shot.
      jakenhauser23
    • RE: We need help with the strange disappearance of Dancho Danchev

      Our ambassador there:

      Diplomatic representation from the US:

      chief of mission: Ambassador James B. WARLICK, Jr
      embassy: 16 Kozyak Street, Sofia 1407
      mailing address: American Embassy Sofia, US Department of State, 5740 Sofia Place, Washington, DC 20521-5740
      telephone: [359] (2) 937-5100
      FAX: [359] (2) 937-5320
      imariot
    • Hey

      @Ryan Naraine this is Lance, can you contact me offlist at dancho@securescience.net - I have some bulgarian gov contacts you may want to chat with to see if they have any light with the situation. Thanks.
      lancej2600
  • RE: We need help with the strange disappearance of Dancho Danchev

    whats his twitter account?
    allanonmage
    • RE: We need help with the strange disappearance of Dancho Danchev

      @allanonmage Nom de Tweet, surely?
      dewex.ltd
    • RE: We need help with the strange disappearance of Dancho Danchev

      He was tweeting on Oct. 20th; even to Mary Jo Foley on Oct. 16th...
      mrtuba9
  • RE: We need help with the strange disappearance of Dancho Danchev

    Alert EU authorities. Bulgaria is EU member state and they may throw in their weight. There's Europol, there's Bulgarian EU commisioner...
    kitko
  • hmm...

    have you heard about the rendition program for people that don't keep their mouth shut?
    You should look for enemies as the people and corporations he exposed in his blog.
    Linux Geek
  • &lt;tinfoil hat&gt;

    Sounds very cloak and dagger. Did you look at the properties of the original image file to look for hidden messages or geotags?
    </tinfoil hat>
    roblap