Teodor Vanev Iliev was arrested in Sofia, Bulgaria, for hacking several state institutions.
Experts reconnected him to a cybergang called RansomedVC, which claimed responsibility
for breaching Sony.
The Prosecutor’s Office of the Republic of Bulgaria has announced the arrest of a 21-year-old
hacker known as “Emil Külev” for hacking numerous state institutions, commercial banks,
insurance companies, and other entities. Teodor Vanev Iliev faces charges for crimes
committed from 2020 to 2024, indicating he was 17 when his activities first caught the
attention of law enforcement.
Bulgarian authorities report that the police conducted searches at 20 locations nationwide
before capturing the hacker. Teodor Vanev Iliev, also known as MAGADANS, gained
notoriety in Bulgaria after allegedly leaking data from the insurance company LEV INS. The
company’s owner was assassinated a month after the data leak was posted on BreachForums.
While Iliev’s arrest announcement did not specify any affiliations with ransomware gangs,
researchers have previously noted similarities between “Emil Külev” and the cybergang
RansomedVC.
In late 2023, RansomedVC claimed responsibility for hacking several large companies,
including Sony Corporation. However, some researchers believed that some of the purported
RansomedVC hacks were either fake or attempts to resell previously stolen data. The gang
eventually dissolved after its owner unsuccessfully tried to sell the operation.