Bulgaria cyber 'elves' fight Kremlin and cruelty
Petkov, a Bulgarian software developer and system architect, poses for a portrait in Kyiv. He is the only public face of the 'BG Elves', a Bulgarian group of around 70 anonymous cyber security experts, which gained prominence for revealing Russian interference in the country, including via disinformation campaigns. Most recently, the group helped an animal rights NGO uncover evidence that led to the arrest of a woman and a man accused of brutally torturing hundreds of animals to death and selling videos of it online. — AFP
SOFIA, Bulgaria: A Bulgarian group of dozens of cyber activists at first clubbed together to battle Russian disinformation, but they have since found other foes – like animal abusers.
They call themselves the BG Elves, which both refers to the kind-hearted characters of Scandinavian mythology and hints at a rivalry with the Internet's malicious trolls.
The collective of about 70 anonymous cyber security experts have made a name for themselves by creating problems for their adversaries.
One of their latest efforts was helping an animal rights NGO uncover evidence that led to the March arrest of a woman and a man accused of selling videos online of hundreds of animals being tortured to death.
"Our work was crucial, because for the first time a crime was solved in Bulgaria based on OSINT data, proving that our efforts can produce concrete results," software developer Petko Petkov, the Elves' only public face, told AFP.
OSINT refers to open-source intelligence, which is information gathered with digital investigation techniques like reverse image search and geolocation.
In the summer of 2024, the NGO alerted the cyber sleuths to videos posted on Telegram of a masked woman torturing animals. The Elves tracked her down within hours.
Using OSINT, they were also able to trace the locations where the videos of cats, rabbits and guinea pigs being tortured on camera were filmed by her accomplice.
The videos sparked widespread protests in Bulgaria, and prompted the government to propose emergency legislation.
'Counter-propaganda'
Set up in 2023 in response to pro-Kremlin disinformation flooding Bulgaria, the group first zeroed in on the key players involved in the campaigns.
"There were about 10 of us in a chat group, we refined the concept, then put out a call for volunteers," Petkov told AFP about the group's founding.
They have grown significantly since and include experts in cyber security, social engineering and databases.
"We are not hackers, we are researchers," said Petkov, 37, who moved from central Bulgaria to Kyiv shortly after Russia's invasion of Ukraine in 2022.
Dedicated to activism, the Elves try to fight the deluge of disinformation by disseminating "counter-propaganda that makes people think", he said.
"We noticed that a (disinfo) narrative... takes some time to reach people. Our idea was to flood the space with humour and irony before the propaganda takes hold," said Petkov.
Recently, they launched a viral meme campaign targeting the main false claims about Bulgaria's accession to the eurozone, distributing the content through profiles embedded within major disinformation networks.
In March, BG Elves supported a Romanian journalist in an investigation that exposed a Russia-linked disinformation and propaganda network funded through online advertising.
'More serious' cases
In the wake of the recent arrests, Bulgaria proposed a bill in parliament, which allows for higher prison terms of up to 10 years for torturing animals.
Nearly 300 people have been convicted of such offences in the last five years, but few end up in prison.
Petya Altimirska, president of the animal welfare association CAAI, who had reached out to the Elves for help in the abuse case, has since received numerous reports of "even more serious" cases, adding that the cyber sleuths are already "on it".
While the group was praised for exposing the animal abuse, it has also faced criticism and numerous threats for its provocative approach and alleged political bias. – AFP
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
The Star
3 hours ago
- The Star
Ispace aborts Moon mission
Space setback: Hakamada (centre) waiting with members of his team for news of the expected landing on the Moon by the company's Resilience craft, in Tokyo. — AFP The country's hopes of achieving its first soft touchdown on the Moon by a private company were dashed when the mission was aborted after an assumed crash-landing, the startup said. Tokyo-based ispace had hoped to make history as only the third private firm – and the first outside the United States – to achieve a controlled arrival on the lunar surface. But 'based on the currently available data ... it is currently assumed that the lander likely performed a hard landing', the startup said yesterday. 'It is unlikely that communication with the lander will be restored' so 'it has been decided to conclude the mission', ispace said in a statement. The failure comes two years after a prior mission ended in a crash. The company's unmanned Resilience spacecraft began its daunting final descent and 'successfully fired its main engine as planned to begin deceleration', ispace said. Mission control confirmed that the lander's positioning was 'nearly vertical' – but contact was then lost, with the mood on a livestream from mission control turning sombre. Technical problems meant 'the lander was unable to decelerate sufficiently to reach the required speed for the planned lunar landing', ispace said. To date, only five nations have achieved soft lunar landings: the Soviet Union, the United States, China, India and most recently Japan. Now, private companies are joining the race, promising cheaper and more frequent access to space. On board the Resilience lander were several high-profile payloads. They included Tenacious, a Luxembourg-built micro rover; a water electrolyser to split molecules into hydrogen and oxygen; a food production experiment; and a deep-space radiation probe. The rover also carried 'Moonhouse' – a small model home designed by Swedish artist Mikael Genberg. 'I take the fact that the second attempt failed to land seriously,' chief executive officer Takeshi Hakamada told reporters. 'But the most important thing is to use this result' for future missions, he said, describing a 'strong will to move on, although we have to carefully analyse what happened'. Last year, Houston-based Intuitive Machines became the first private enterprise to reach the Moon. Though its uncrewed lander touched down at an awkward angle, it still managed to complete tests and transmit photos. Then in March this year, Firefly Aerospace's Blue Ghost – launched on the same SpaceX rocket as ispace's Resilience – aced its lunar landing attempt. The mood ahead of yesterday's attempt had been celebratory, with a watch party also held by ispace's US branch in Washington. After contact was lost, announcers on an ispace livestream signed off with the message: 'Never quit the lunar quest.' The mission had also aimed to collect two lunar soil samples and sell them to Nasa for US$5,000 (RM21,150). Though the samples would remain on the Moon, the symbolic transaction is meant to strengthen the US stance that commercial activity – though not sovereign claims – should be allowed on celestial bodies. — AFP
The Sun
3 hours ago
- The Sun
Israel warns of more Lebanon strikes if Hezbollah not disarmed
BEIRUT, LEBANON: Israel warned Friday that it would keep striking Lebanon until militant group Hezbollah has been disarmed, after hitting south Beirut in what Lebanese leaders called a major violation of a November ceasefire. Thursday's attacks on what the Israeli military said were underground Hezbollah drone factories came after an Israeli evacuation call on the eve of Eid al-Adha, a key Muslim religious festival, and sent huge numbers of residents of Beirut's southern suburbs fleeing. It was the fourth and heaviest Israeli bombardment of the heavily populated area, known as a bastion of support for Hezbollah, in the six months since a ceasefire deal aimed at ending hostilities between Hezbollah and Israel. The last attack was in late April. 'There will be no calm in Beirut, and no order or stability in Lebanon, without security for the State of Israel,' Israeli Defence Minister Israel Katz said in a statement. 'Agreements must be honoured and if you do not do what is required, we will continue to act, and with great force.' The state-run National News Agency reported around a dozen strikes, while Health Minister Rakan Nassereldine said several people were wounded by flying glass. AFP photographers on Friday saw huge destruction as residents, some wearing masks, inspected the debris and damage to their homes. - 'Blatant act' - A Hezbollah statement said a preliminary assessment showed nine buildings were completely destroyed and dozens of others damaged. A woman in her 40s who lives near one of the strike sites said she fled on foot with her young children including a three-month-old baby. 'Thank God' the building was not destroyed, she told AFP after returning Friday morning to find the windows of her flat shattered. South Beirut resident Fatima, 40, said 'life goes on', adding that she and her two children were following the usual Eid traditions after fleeing the previous night. Hezbollah sparked months of deadly hostilities by launching cross-border attacks on northern Israel in stated solidarity with Palestinian ally Hamas following its October 7, 2023 attack. France, part of a committee overseeing the ceasefire, condemned the strikes and urged all parties to respect the truce, noting that the monitoring mechanism 'is there to help the parties deal with threats and prevent any escalation'. Lebanese President Joseph Aoun late on Thursday voiced 'firm condemnation of the Israeli aggression' and 'flagrant violation of an international accord... on the eve of a sacred religious festival'. Prime Minister Nawaf Salam condemned the strikes as a violation of Lebanese sovereignty. Hezbollah lawmaker Ali Ammar on Friday urged 'all Lebanese political forces... to translate their statements of condemnation into concrete action', including diplomatic pressure. Hezbollah backer Iran called the strikes 'a blatant act of aggression against Lebanon's territorial integrity and sovereignty', foreign ministry spokesman Esmaeil Baqaei said. The war left Hezbollah massively weakened, with top commanders including longtime leader Hassan Nasrallah killed and weapons caches incinerated. - 'Refusal to cooperate' - Under the ceasefire, Lebanon should disarm Hezbollah, once reputed to be more heavily armed than the state. A Lebanese military official told AFP the committee received no warning before the Israeli evacuation order. The Lebanese army 'attempted to go to one of the sites... but Israeli warning shots prevented it from carrying out its mission', the official said, requesting anonymity. Lebanon's army, which has been dismantling Hezbollah infrastructure under the truce, said the Israeli military's ongoing violations and 'refusal to cooperate' with the ceasefire monitoring mechanism 'could prompt the (Lebanese) military to freeze cooperation' on site inspections. The French foreign ministry statement noted that 'dismantling unauthorised military sites... falls as a priority to the Lebanese' army with the support of United Nations peacekeepers. The Israeli military had said Hezbollah was 'operating to increase production of UAVs (drones) for the next war' in 'blatant violation' of the truce understandings. Under the ceasefire, Hezbollah fighters were to withdraw north of the Litani river, about 30 kilometres (20 miles) from the Israeli border. Israel was to withdraw troops from Lebanon but has kept them in five areas it deems 'strategic' and still launches regular strikes on south Lebanon. Israel's military also issued an evacuation warning for the southern village of Ain Qana. It then struck a building there that it alleged was a Hezbollah base, according to the NNA.
The Star
3 hours ago
- The Star
This is the phishing scam that gets an identity theft expert in the US 'really, very angry'
Digital thieves are nothing if not persistent and innovative. They keep finding new ways to try to part you from your money. Phishing – where thieves pose as trusted entities or send legitimate looking emails or messages to trick you into giving them access to your accounts – is a widespread method. And it is constantly evolving. 'We've seen phishing go through the roof,' said Eva Velasquez, the CEO of the Identity Theft Resource Center, a San Diego-based national nonprofit. But knowledge is power. So here are three emerging phishing threats to look out for, according to Internet safety experts. All three threats target key parts of people's digital lives: email attachments that lead to fake login pages, multi-factor authentication trickery and deceptive calendar invites. Spending a few minutes reading these pointers could help you avoid getting your ID or money stolen and save you countless hours of dealing with the fallout. HTML attachments that open fake login pages Imagine a busy professional who is in email action mode. In the past 30 minutes on a Saturday morning, he has filled out emailed liability waivers for his seven children's summer camps, filed an expense report for work, answered a secure portal message from the veterinarian about his sick puppy's prescription, skimmed 182 email subject lines and paid five bills from his email inbox, including a car insurance premium and his beloved cheese-of-the-month club. Amid this flurry of inbound emails, ads, invoices and secure messages, he is working on autopilot: opening messages, skimming, clicking and signing in. What a perfect opportunity. Scammers are taking advantage of user distraction – and their trust – by sending emails with HTM or HTML attachments. When clicked, those open a browser file that looks like secure, familiar login page. These pages might look like secure invoice viewers, file-sharing services like DocuSign or Dropbox, or sign-in pages to platforms including Microsoft 365. 'Once the user enters their credentials, they are sent surreptitiously to the attacker's server,' said Vlad Cristescu, the head of cybersecurity with ZeroBounce, a Florida company that helps businesses lower their rate of bounced marketing emails. Why this method is especially insidious: 'There isn't a clickable link in the email, so standard email security filters (which scan for malicious URLs or attachments like PDFs and ZIPs) may not catch it,' Cristescu added. To prevent this, he added, companies should 'restrict HTML attachments unless essential, and users should treat unfamiliar HTML files the same way they'd treat a suspicious link – don't open it unless you're absolutely sure of the sender.' If you do receive incoming communication with an HTML link or attachment, don't engage, said Velasquez, with the ITRC. 'Don't click on links, people. That's the big, overarching message,' she said. Instead, go to the source: call the phone number on the back of your credit card, visit the bank in person. Multifactor authentication tricks If you are one of the many people who uses multifactor authentication, take note. Multifactor authentication is still very helpful and should be used. But Cristescu flagged one way that scammers are taking this tool – which is designed to make people's online accounts more secure – and using it to slither in. As a refresher, multifactor authentication is an added layer of protection that prevents data thieves from logging into your accounts if they have your username and password. It helps ensure that you're the one who typed in your password when you log in, and not some scammer in the Philippines or Poughkeepsie. To use multifactor authentication, you typically download an app, such as Google Authenticator or Microsoft Authenticator. You register your sensitive online accounts, such as Facebook, bank or email, with that app. Then, every time you log into a registered website, the authenticator app generates a new, random code that you enter after your password as a second layer of verification. With the rise of this protection, a new threat has emerged: Scammers who have your username and password can send log-in requests to your authenticator app. Next, the scammer can pose as an IT expert from your workplace and ask you to approve the log-in request. If you fall for it, then boom – the scammer is in. This technique 'exploits a user's frustration and trust in IT. If you're receiving multiple (authenticator) prompts you didn't initiate, that's not a glitch – it's an attack,' Cristescu said. He recommends pausing, never approving these unexpected requests and flagging the interaction with IT. Velasquez added that if you get an authenticator notification and you didn't just log in yourself, 'That is a huge red flag. Stop and address it. Don't ignore it.' Anytime you interact with IT, be sure you're the one initiating that contact, she added. If someone from IT calls or emails you, disconnect and reach back out using a trusted method, such as the same phone number you always dial. Fake calendar invites A third technique data thieves are using is calendar invites. 'I just get really very angry about this one,' Velasquez said. 'It is super hard to detect.' Here's what to look out for. If you use an online calendar like Google calendar or the native iPhone calendar app, you might receive an invitation to an event you didn't see coming. Sometimes these meetings are legitimate. Sometimes, they are not. Scammers 'are now sending meeting requests with malicious links embedded in the invite or 'join' button. These invitations sync directly into calendars and often go unquestioned,' according to ZeroBounce. Scammers use calendar invites because they have 'built-in credibility – they're not usually scrutinised like emails,' Cristescu said. Look for meeting requests from unknown senders and vague event names like 'Sync' or 'Project Review,' he added. In some jobs or roles, meetings routinely get added to calendars by other people –clients, prospects, coworkers, bosses, peers. 'I have gotten these repeatedly,' said Velasquez, with the ITRC. 'Depending on your lifestyle and your job and how you work, these are going to be particularly challenging. They are real calendar invites. The problem is they have malicious software embedded in them – so when you click on portions of them, 'Click to join,' it's like opening an attachment (or) clicking on a suspicious link. It's the same principle.' Cristescu, with ZeroBounce, shared this tip: 'Treat those just like a phishing email. Disable auto-accept where possible and review every invite manually before clicking anything.' Never stop questioning what lands in your inbox or calendar, Cristescu added. 'Always verify the sender's email address, ensure that any link you click matches the legitimate domain, and look out for subtle red flags like spelling errors or unusual formatting.' A big picture pointer 'All three of these (scams) are so common that it has probably happened to every single person reading the article – at least one of them. That's how ubiquitous these are,' Velasquez said. She shared this broader thought: It's less important to know how to respond to each scenario and more important to pause, be skeptical, double check. It's important to be ever more sceptical, because AI makes it easier and easier for thieves to create convincing ruses, Cristescu and Velasquez both said. AI 'really helps with making these phishing offers look and sound so much more legitimate,' Velasquez said. 'And with the amount of data that is out there from public sources and from data breaches, it's very easy to see what relationships people have.' Where you bank, where you do business – that is all fodder for someone to create a copycat page designed to trick you into logging in. Adopt an 'investigator mindset,' Velasquez said. Use this helpful reminder: the acronym STAR, which stands for Stop. Think. Ask questions or ask for help. Reassess. – The San Diego Union-Tribune/Tribune News Service
