In June and July 2016,
Cybersecurity experts and firms, including
CrowdStrike,
[64] Fidelis,
Mandiant,
SecureWorks and
ThreatConnect, stated the leak of emails in the 2016 U.S. elections was part of
a series of cyberattacks on the DNC committed by two Russian intelligence groups, called
Fancy Bear and
Cozy Bear,
[19] also known respectively as APT28 and APT29.
[64][Note 1] Other actors working in connection with APT28 were called Sofacy, Sednit and Pawn Storm, collectively labeled by SecureWorks as Threat Group 4127 (TG-4127).
[66] ThreatConnect also noted possible links between the
DC Leaks project and
Russian intelligence operations because of a similarity with Fancy Bear attack patterns.
[67] DC Leaks had published material from
NATO General
Philip Breedlove and from
George Soros'
Open Society Foundations.
[68] Fancy Bear was also suspected of hacking the
world anti-doping agency in relation with the
expulsion of Russian athletes from the
2016 Olympic Games.
[69]
In December 2016,
Ars Technica IT editor Sean Gallagher reviewed the publicly available evidence, and wrote that attribution of the DNC hacks to Russian intelligence was based on clues from attack methods and similarity to other cases, as the hacking was tracked in real time since May 2016 by CrowdStrike's monitoring tools.
[70] SecureWorks stated that the actor group was operating from Russia on behalf of the Russian government with "moderate" confidence level, defined as "credibly sourced and plausible but not of sufficient quality or corroborated sufficiently to warrant a higher level of confidence".
[66] Cybersecurity analyst
Jeffrey Carr stated that CrowdStrike's inferences pointing at the Russian intelligence services were baseless because the incriminated
X-Agent tool was freely available for anyone to download.
[71] Wordfence and Errata Security noted that the PHP malware referenced in the JAR was an out-of-date version "used by hundreds if not thousands of hackers, mostly associated with Russia, but also throughout the rest of the world."
[72]