Dark Avenger

Background and Origins

Dark Avenger emerged from a specific technological and cultural context in Cold War-era Bulgaria. The Bulgarian government had authorized projects to reverse-engineer Western technology, leading to the Pravetz line of personal computers in the 1980s — clones of popular Western machines that were deployed in schools to teach programming. This created a community of young, technically skilled programmers.

In April 1988, Bulgaria's computer trade magazine Компютър за Вас (Computer for You) published a translated German article on computer viruses and methods for writing them. Within months, several foreign viruses appeared in Bulgaria. The combination of the article and the live virus samples inspired local programmers to write their own. An early wave of Bulgarian viruses followed, beginning with "Old Yankee" and "Vacsina." Dark Avenger made his first appearance in the spring of 1989. At the time, Bulgarian law contained no prohibition against writing computer viruses.

Anti-virus researchers noted that Bulgaria had talented programmers with limited commercial opportunities. Bulgarian security researcher Vesselin Bontchev attributed the virus wave partly to the country's history of pirating Western software and a failure to instill computer ethics in students.

Viruses

Dark Avenger's first virus appeared in early 1989 and contained the string: "This program was written in the city of Sofia (C) 1988–89 Dark Avenger." The virus is typically referred to by its author's pseudonym. The pseudonym itself is drawn from a Manowar song, and Dark Avenger's viruses frequently referenced heavy metal bands, including Iron Maiden, as well as Diana, Princess of Wales.

The initial Dark Avenger virus was notably infectious: with the virus active in memory, simply opening or copying an executable file was sufficient to infect it. The virus also carried a destructive payload, overwriting a random disk sector on every 16th execution of an infected program, progressively corrupting files and directories. Corrupted files contained the string "Eddie lives... somewhere in time!" — a reference to Iron Maiden. Due to its high infectivity, the virus spread to Western Europe, the USSR, the United States, and East Asia.

Dutch author Harry Mulisch reported encountering the virus on his laptop while writing The Discovery of Heaven, briefly considering naming a character Eduard after the virus's output before having it professionally removed.

Dark Avenger is believed to have authored a substantial catalog of viruses, including: Dark Avenger, V2000 (two variants), V2100 (two variants), 651, Diamond (two variants), Nomenklatura, 512 (six variants), 800, 1226, Proud, Evil, Phoenix, Anthrax, and Leech. Bulletin board systems served as his primary channel for distributing virus source code.

Notable Work: The Mutation Engine

The most technically significant contribution attributed to Dark Avenger is the mutation engine (MtE). This component allowed viruses to change their own code signatures with each infection, making them substantially harder for antivirus software to detect through signature-based scanning. Upon its release, authors Paul Mungo and Bryan Clough described MtE as "the most dangerous virus ever produced," and researcher Steve Gibson wrote that "the game is forever changed."

Identity

The true identity of Dark Avenger has never been publicly confirmed. In 1992, Dark Avenger described himself as a heavy metal fan under 30 who wrote viruses while procrastinating at work.

Security researcher Sarah Gordon made public contact with Dark Avenger after requesting that a virus be named after her and using the exchange as an opening for communication. She later published their correspondence in interview format. Researchers Andrew Bissett and Geraldine Shipton analyzed this material and concluded that Dark Avenger engaged in victim blaming, attributing virus transmission to "human stupidity" and dismissing the value of data on personal computers. They cited envy of wealthy Westerners' access to computers as a motivating factor; Gordon herself attributed his actions partly to animosity toward Bontchev.

Dark Avenger made repeated attacks on Bontchev, including embedding false copyright strings claiming Bontchev authored the V2000 and V2100 viruses. This conflict led some observers to speculate that the two were promoting each other or were even the same person. Bontchev denied this and claimed in 1993 to have identified Dark Avenger, but noted that since virus writing was not illegal, there was no reason to pursue the matter.

A 1997 Wired article by journalist David S. Bennahum brought renewed attention to Dark Avenger's identity. Bennahum did not uncover it but came to suspect the operator of a Bulgarian bulletin board system that collected viruses in the 1990s. Neither that individual nor someone claiming to be Dark Avenger confirmed or denied the connection.