Mass reports of "explosive devices" were sent via email to the airports in Sofia and Varna, the Sofia hospital "St. Sofia", the "Dormition of the Theotokos" Cathedral in Varna, the bridge between Romania and Bulgaria at Ruse, as well as to a number of schools, media outlets, and institutions across the country.
Messages were also received regarding the building of the Bulgarian National Television, as well as regional centers of the Bulgarian National Radio. Some of the emails included threats of explosive devices in public places and "recruited suicide bombers".
Third day of a wave of fake reports
The wave of fake reports continues for the third consecutive day. The sender, this time too, used an Italian domain. Some of the messages contain claims of affiliation with the "Islamic State" group and threats of violence.
According to cybersecurity experts, the writing style in the emails suggests the use of artificial intelligence or automated translation, which further complicates the identification of the real author.
Airports and key facilities under increased surveillance
Authorities are checking all reports according to standard procedure. The "Vasil Levski" Sofia Airport reported that a signal was received and the necessary inspection measures were taken, but the airport's operations were not interrupted.
The Ministry of Internal Affairs indicated that the "Cybercrime" department of the General Directorate for Combating Organized Crime is working on the case and analyzing the source and content of the threats.
Evacuations and inspections in schools and media
Similar reports were received in schools in several regions, including Burgas, Sliven, and Kardzhali. Students and staff were evacuated, and the buildings were inspected by specialized teams.
No explosive devices were found during any of the inspections. In Kardzhali, dozens of reports were made to schools and Bulgarian National Radio editorial offices. Similar messages were received in Nova Zagora and other settlements, all of which turned out to be false.
Suspicions of international cyber-structures
Suspicions that organized cyber-structures are behind some of the mass bomb threats sent via email to institutions and facilities in Bulgaria. Investigators are unofficially pointing to groups known as "commers", as well as the extremist and misanthropic "Organization 764", which operates in various countries.
These structures engage in various criminal online activities. Some of them are linked to encouraging self-harm and suicide among minors. In this specific case, the hypothesis of branches distributing bomb threat emails to different countries is also being investigated.
Cyber-bullies who boast about "putting services on alert"
According to available data, such groups use chat channels where, after sending the alerts, the organizers boast that they have "put the services on alert". It is noted that the organizations have members in different parts of the world and, by internal rules, refrain from sending threats to the country from which the participants originate.
The possibility that some of the messages were sent by local imitators, who copy the model and use the same channels and formats, is not excluded.
Coincidence with 4th-grade exams
The wave of threats began on Tuesday and coincides with the holding of the "National External Assessment" in Bulgarian language and literature for fourth-graders. In individual cases, schools were temporarily closed while inspections were carried out.
The Ministry of Internal Affairs confirmed to BNT that the "Cybercrime" department of the General Directorate for Combating Organized Crime continues to work on the case, with the goal of identifying both international and potential local sources of the threats.