A profile of Dark Avenger, a pseudonymous PC virus writer from Bulgaria who gained notoriety in the 1990s after the country became known as the “virus factory”
Bulgaria in the 1980s became known as the ‘virus factory’, where hundreds of malicious computer programs were unleashed to wreak havoc. Tweets: @realhackhistory , @jkosseff , @scottjshapiro , @gcluley , and @opsprof Tweets: @realhackhistory : An account of virus writing & distribution in 80s and 90s Bulgaria, with the added mystique of the infamous Dark Avenger https://www.theguardian.com/ ... Jeff Kosseff / @jkosseff : I read an advance copy of this book by @scottjshapiro and the entire book is this good. Looking forward to assigning it next semester. https://twitter.com/... Scott Shapiro / @scottjshapiro : My piece on the Bulgarian virus factory and the mysterious Dark Avenger. I worked hard on it and will hurt my feelings if you don't read it. https://www.theguardian.com/ ... @gcluley : On the trail of the Dark Avenger: the most dangerous virus writer in the world https://www.theguardian.com/ ... (Some familiar names from the early days of anti-virus mentioned in this article) cc @VessOnSecurity Michael Lewis / @opsprof : “Bontchev's articles detailing the dangers of viruses had an unintended consequence: they inspired... His readers learned how to write viruses from the articles, and some tried to improve existing versions.” #longreads #cybersecurity #innovation https://www.theguardian.com/ ...?
Context & Ripple Effects
Scott Shapiro's Guardian piece revisits a foundational chapter of malware history: 1980s Bulgaria, where hundreds of PC viruses were written and released, earning the country the label "virus factory" — and the pirated Leisure Suit Larry disks blamed for spreading the Jerusalem DOS virus show how that output reached Western machines. Within the scene, the relationships note an ironic engine of growth: Bontchev's anti-virus articles inadvertently taught readers how to write viruses, feeding the very outbreak they analyzed.
The piece also matters because the Dark Avenger remains unidentified decades later, making him an early case study in pseudonymous malware authorship — a problem that has only grown as the ecosystem professionalized into figures like Volodya, the prolific Windows exploit developer Kaspersky Lab profiled and communities such as The Com, the online network linked to Scattered Spider.
First-order effects
- Readers and security-history researchers get the most detailed English-language account yet of the Bulgarian virus factory era, with Shapiro's book — which Jeff Kosseff says he will assign next semester — entering university syllabi as a canonical text on malware's origins.
Second-order effects
- Renewed attention to the Dark Avenger's unresolved identity puts pressure on the attribution question that runs through later profiles of pseudonymous figures like Volodya, showing how little has changed in identifying skilled anonymous malware authors across three decades.
Third-order effects
- If the pattern holds, malware history keeps rhyming: a hobbyist scene in one country maturing into a commercial underground — from Bulgaria's virus writers through zero-day brokers to today's extortion networks — with legal infrastructure lagging, as seen in the niche role of specialists like Arkady Bukh, the go-to defense lawyer for the former-Soviet-bloc cybercrime underworld.
The trend: Malware authorship has evolved from national hobbyist scenes like Bulgaria's virus factory into a globalized, professionalized criminal industry whose anonymity problem was never solved.