In 2018, a US Special Counsel indictment named Fancy Bear as GRU Unit 26165, giving the group the unified Military Unit Number of a Russian army regiment. Before that, the attribution rested on private security firms. CrowdStrike said with medium confidence that the group is tied to the GRU, Russia’s military intelligence agency. The UK Foreign and Commonwealth Office, SecureWorks, ThreatConnect and Mandiant have all said it is sponsored by the Russian government.
FireEye classes the group as an advanced persistent threat, APT28. It likely has been active since the mid-2000s.
Where the name comes from
Dmitri Alperovitch’s company CrowdStrike names hacker groups with a code. “Bear” means Russia. “Fancy” traces to “Sofacy”, a word found in the group’s malware that reminded the analyst of Iggy Azalea’s song “Fancy”.
The evidence trail
FireEye’s October 2014 report described zero-day exploits against Microsoft Windows and Adobe Flash. Its researchers found the malware was compiled mostly in a Russian-language build environment, and mostly during hours matching Moscow’s time zone. The report pointed to a “government sponsor based in Moscow”. Trend Micro, for its part, labelled the actors behind the Sofacy malware Operation Pawn Storm on October 22, 2014.
Who it goes after
The list is long. Government, military and security agencies in many countries, often Transcaucasian and NATO-aligned states. The World Anti-Doping Agency. The group is thought to be behind attacks on the German parliament, the Norwegian parliament, the French broadcaster TV5Monde, the White House, NATO, the Democratic National Committee, the OSCE and Emmanuel Macron’s presidential campaign.
Defense contractors including Boeing, Lockheed Martin and Raytheon have been targets. So have Kremlin opponents inside Russia, among them the former oil tycoon Mikhail Khodorkovsky and Maria Alekhina of Pussy Riot.
SecureWorks concluded that from March 2015 to May 2016 the target list took in the Democratic and Republican national committees and tens of thousands of critics of Putin and the Kremlin in the United States, Ukraine, Russia, Georgia and Syria. An AP analysis of 4,700 attacked email accounts found nothing linking the victims except their interest to the Russian government.
Hacking Democratic National Committee emails to try to influence the 2016 US presidential election is the operation the group is best known for.
Back in 2020
In September 2020, Microsoft’s Tom Burt said the group, widely known as Fancy Bear, had spent the previous year trying to break into accounts of political consultants serving both Republicans and Democrats, plus advocacy groups and think tanks. Microsoft warned a firm advising the Biden campaign that it was a target. Burt gave no detail on the Russian effort.
The Russian Embassy’s press secretary, Nikolay Lakhonin, rejected the allegations, saying Americans had talked about “so-called ‘interference’” for years without producing “factual evidence”. John Hultquist, an analyst at Mandiant, said the group’s history of leaking hacked data “raises the prospect of follow-on information operations or other devastating activity”.
