“The activity by [Russian intelligence services] is part of an ongoing campaign of cyber-enabled operations directed at the US government and its citizens,” wrote the authors of the government report. “This [joint analysis report] provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the US government.”
The government report follows several from the private sector, notably a lengthy section in a Microsoft report from 2015 on a hacking team referred to as “advanced persistent threat 28” (APT 28), which the company’s internal nomenclature calls Strontium and others have called Fancy Bear. Also mentioned in the government document is another group called APT 29 or Cozy Bear.
Before the government report, other security researchers tracked “the bears” to breaches including
the summer 2016
attack on the World Anti-Doping Agency, apparently an act of revenge against whistleblowing Russian athlete Yuliya Stepanova. Other attacks attributed to the same set of apparently Russian actors include an attack on Georgian elections in 2008, the hack of French news channel TV5Monde, and a Twitter account and blog supposedly operated by a hacker calling himself Guccifer 2.0 but more likely an
instrument of Fancy Bear.
The Microsoft
report contains a history of the groups’ operation; a
report by security analysts ThreatConnect describes the team’s modus operandi; and competing firm CrowdStrike
detailed the attack on the Democratic National Committee shortly before subsequent breaches of the Democratic Congressional Campaign Committee and the Hillary Clinton campaign were discovered.