Intelligence analysis of attack
In June and July 2016,
cybersecurity experts and firms, including
CrowdStrike,
[97] Fidelis,
FireEye,
[98] Mandiant,
SecureWorks,
[99] Symantec[98] and
ThreatConnect, stated the DNC email leaks were part of
a series of cyberattacks on the DNC committed by two Russian intelligence groups, called
Fancy Bear and
Cozy Bear,
[100][101] also known respectively as
APT28 and APT29 / The Dukes.
[102][103][97][104] ThreatConnect also noted possible links between the
DC Leaks project and
Russian intelligence operations because of a similarity with Fancy Bear attack patterns.
[105] SecureWorks added that the actor group was operating from Russia on behalf of the Russian government.
[106][107] de Volkskrant later reported that Dutch intelligence agency
AIVD had penetrated the Russian hacking group
Cozy Bear in 2014, and observed them in 2015 hack the State Department in real time, while capturing pictures of the hackers via a security camera in their workspace.
[108][109] American, British, and Dutch intelligence services had also observed stolen DNC emails on Russian military intelligence networks.
[110]