Instruct: Given a question, retrieve passages that answer the question.
Query: What has Fancy Bear done?
Likely operating since the mid-2000s, Fancy Bear's methods are consistent with the capabilities of state actors. The group targets government, military, and security organizations, especially Transcaucasian and NATO-aligned states. Fancy Bear is thought to be responsible for cyber attacks on the German parliament, the French television station TV5Monde, the White House, NATO, the Democratic National Committee, Organization for Security and Co-operation in Europe and the campaign of French presidential candidate Emmanuel Macron.[11]
In February 2017, the General Intelligence and Security Service (AIVD) of the Netherlands revealed that Fancy Bear and Cozy Bear had made several attempts to hack into Dutch ministries, including the Ministry of General Affairs, over the previous six months. Rob Bertholee, head of the AIVD, said on EenVandaag that the hackers were Russian and had tried to gain access to secret government documents.[66]
The Swedish Sports Confederation reported Fancy Bear was responsible for an attack on its computers, targeting records of athletes' doping tests.[76]
Fancy Bear's targets have included Eastern European governments and militaries, the country of Georgia and the Caucasus, Ukraine,[20] security-related organizations such as NATO, as well as US defense contractors Academi (formerly known as Blackwater), Science Applications International Corporation (SAIC),[21] Boeing, Lockheed Martin, and Raytheon.[20] Fancy Bear has also attacked citizens of the Russian Federation that are political enemies of the Kremlin, including former oil tycoon Mikhail Khodorkovsky, and Maria Alekhina of the band Pussy Riot.[20] SecureWorks, a cybersecurity firm headquartered in the United States, concluded that from March 2015 to May 2016, the "Fancy Bear" target list included not merely the United States Democratic National Committee, but tens of thousands of foes of Putin and the Kremlin in the United States, Ukraine, Russia, Georgia, and Syria. Only a handful of Republicans were targeted, however.[22] An AP analysis of 4,700 email accounts that had been attacked by Fancy Bear concluded that no country other than Russia would be interested in hacking so many very different targets that seemed to have nothing else in common other than their being of interest to the Russian government.[20]
In August 2015, Fancy Bear used a zero-day exploit of Java, spoofing the Electronic Frontier Foundation and launching attacks on the White House and NATO. The hackers used a spear phishing attack, directing emails to the false url electronicfrontierfoundation.org.[45][46]
In June 2016, Cozy Bear was implicated alongside the hacker group Fancy Bear in the Democratic National Committee cyber attacks. While the two groups were both present in the Democratic National Committee's servers at the same time, they appeared to be unaware of the other, each independently stealing the same passwords and otherwise duplicating their efforts. A CrowdStrike forensic team determined that while Cozy Bear had been on the DNC's network for over a year, Fancy Bear had only been there a few weeks. Cozy Bear's more sophisticated tradecraft and interest in traditional long-term espionage suggest that the group originates from a separate Russian intelligence agency.
Fancy Bear (also known as APT28, Pawn Storm, Sofacy Group, Sednit and STRONTIUM)[2] is a cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU.[4][5] The Foreign and Commonwealth Office,[6] and security firms SecureWorks,[7] ThreatConnect,[8] and Fireeye's Mandiant,[9] have also said the group is sponsored by the Russian government. In 2018, an indictment by the United States Special Counsel identified Fancy Bear as two GRU units known as Unit 26165 and Unit 74455.[3][2]
The next activity is a high diving act. Mama Bear begins playing the drums and Papa Bears dives to the pail of water. However, Junyer steps in eating salt crackers and drinks the pail of water making Papa Bear land on the empty pail. Junyer realizes this what he has done and calls Mama Bear to call for a doctor. Papa Bear proceeds the motorcycle race with Mama Bear holding the finish flag and asks her if she is ready and she replies and Papa Bear starts his motorcycle. Mama Bear swings the flag and watches the race. However Junyer is eating a banana and throws the banana peel onto the track, causing Papa Bear to crash his motorcycle, injuring him (off screen). Papa Bear wakes up covered in bandages and asks where the newspaper is. Mama Bears hands it to him and protests, only to be silenced when he yells at her to shut up. Henry proceeds to check the address on the circus ad, but finds out that the newspaper was printed on April 16, 1928 and realizes that they are 21 years too late, because the day when he found the ad was on August 1, 1949. Junyer jumps to Mama Bear in fear. Mama Bear says she tried to tell Henry. Papa Bear gets upset because he figures out that they have been practicing all for nothing. Unable to accept the reality of his blunder, he questions why he has such an abnormal family, escapes his house, and attempts suicide by jumping off a cliff. However, he lands in a pail of water set by Junyer, who tells him that he done a good thing, resulting in Papa Bear punching him again which sends Junyer crying and remarking "What I do?! What I do?!" and the cartoon ends.
The name "Fancy Bear" comes from a coding system security researcher Dmitri Alperovitch uses to identify hackers.[10]
Fancy Bear is classified by Fireeye as an advanced persistent threat.[9] Among other things, it uses zero-day exploits, spear phishing and malware to compromise targets.
Network security firm FireEye released a detailed report on Fancy Bear in October 2014. The report designated the group as "Advanced Persistent Threat 28" (APT28) and described how the hacking group used zero-day exploits of the Microsoft Windows operating system and Adobe Flash.[15] The report found operational details indicating that the source is a "government sponsor based in Moscow". Evidence collected by FireEye suggested that Fancy Bear's malware was compiled primarily in a Russian-language build environment and occurred mainly during work hours paralleling Moscow's time zone.[16] FireEye director of threat intelligence Laura Galante referred to the group's activities as "state espionage"[17] and said that targets also include "media or influencers."[18][19]
"Battles of the CYBER BEARS" describes the two hacker entities tied to Russian intelligence: Cozy Bear and Fancy Bear. Cozy Bear is believed to be linked to the Russian Federal Security Service (FSB) or Foreign Intelligence Service (SVR), while Fancy Bear is associated with Russian military intelligence agency GRU. Nance describes how Russian intelligence attempted to make their releases of leaked DNC emails appear deniable. In "WikiLeaks: Russia's Intelligence Laundromat", he likens use of the whistleblower website WikiLeaks to money laundering. Nance asserts WikiLeaks willingly collaborated in the operation. "When CYBER BEARS Attack" describes the impact of Podesta emails and DNC email leaks on the 2016 Clinton campaign.
Through Nexus, Gupta has developed a greater sense of how to work within Indian culture. He said that, “most investors in the U.S. won’t understand how family-run businesses in India run.” Basically, Indian entrepreneurs have to get with the program in order to understand “what tickles the fancy of consumers,” since there has not been one independent firm that has emerged as a key player here, which Gupta says “makes no sense. Korea has done that, Japan has, China has, but not India.”
Fancy determines to keep Luis, however, and buys an extra ticket for Marty to the Boston Bruins game so that the boy can accompany them on a date. Marty instantly bonds with Fancy, and both Luis and Fancy are thrilled at how natural the three are together. However, Pretty, in her quest to win Luis for herself, decides to use Alistair's mind-control device to make Fancy act out. Under Pretty's control, Fancy lashes out at Luis and Sheridan in front of Marty, even taunting the child, telling him that Alistair is hiding under his bed, waiting to kidnap him again. After further episodes, Pretty tries to convince Luis that Fancy has reverted to her partying ways while Sheridan insists that Fancy has reunited with Noah, and Luis, though still deeply in love with Fancy, begins to doubt her love for him. Luis is still trying to sort through his feelings when he and Paloma come across Noah and Fancy, who have been trying to figure out what has been going on between them, on the wharf. At first convinced that Fancy is cheating on him, Luis quickly becomes concerned when Sheridan and Pretty's battle for control of the remote causes Fancy to run into walls, bark like a dog, and, eventually, collapse and stop breathing. Once Fancy regains consciousness, the four quickly realize that there is, indeed, something physically wrong with Fancy and fear a brain tumor. Still, Fancy's near-death experience draws her and Luis closer together than ever before, much to Sheridan and Pretty's chagrin. Pretty tries to use Luis and Fancy's closeness to convince Sheridan to team up with her, but Sheridan cannot abide by having such power over her niece and throws the remote control into the ocean; the water causes the device to short-circuit, and the chip dislodges itself from Fancy's nose. When Noah finds the device, he throws it, too, into the ocean, to Pretty's dismay.
Its theme is the second life after death and presentation in it before man of the full record of the deeds done by him in the world. In the first three sentences it has been told briefly how the second life after death will take place and how confounding it will be for man. In the next two sentences it has been said that this very earth on which man has lived and performed all kinds of deeds thoughtlessly, and about which he never could fancy that this lifeless thing would at some time in the future bear witness to his deeds, will speak out on that Day by Allah's command and will state in respect of each individual person what act he had committed at a particular time and place. Then, it has been said that men on that Day, rising from their graves, will come out in their varied groups from all corners of the earth, to be shown their deeds and works, and their presentation of the deeds will be so complete and detailed that not an atom's weight of any good or evil act will be left unnoticed or hidden from his eyes.
On January 10, 2018, the "Fancy Bears Hack Team" online persona leaked what appeared to be stolen International Olympic Committee (IOC) and U.S. Olympic Committee emails, dated from late 2016 to early 2017, were leaked in apparent retaliation for the IOC's banning of Russian athletes from the 2018 Winter Olympics as a sanction for Russia's systematic doping program. The attack resembles the earlier World Anti-Doping Agency (WADA) leaks. It is not known whether the emails are fully authentic, because of Fancy Bear's history of salting stolen emails with disinformation. The mode of attack was also not known, but was probably phishing.[73][74]
Fancy Bear also seems to try to influence political events in order for friends or allies of the Russian government to gain power.
Five military wives received death threats from a hacker group calling itself "CyberCaliphate", claiming to be an Islamic State affiliate, on February 10, 2015.[30][31][32][33] This was later discovered to have been a false flag attack by Fancy Bear, when the victims' email addresses were found to have been in the Fancy Bear phishing target list.[31] Russian social media trolls have also been known to hype and rumor monger the threat of potential Islamic State terror attacks on U.S. soil in order to sow fear and political tension.[31]
Fancy Bear employs advanced methods consistent with the capabilities of state actors.[82] They use spear phishing emails, malware drop websites disguised as news sources, and zero-day vulnerabilities. One cybersecurity research group noted their use of no less than six different zero-day exploits in 2015, a considerable technical feat that would require large numbers of programmers seeking out previously unknown vulnerabilities in top of the line commercial software. This is a sign that Fancy Bear is a state-run program and not a gang or a lone hacker.[83][84]
On June 14, CrowdStrike released a report publicizing the DNC hack and identifying Fancy Bear as the culprits. An online persona, Guccifer 2.0, then appeared, claiming sole credit for the breach.[60]
In 2011-2012, Fancy Bear's first-stage malware was the "Sofacy" or SOURFACE implant. During 2013, Fancy Bear added more tools and backdoors, including CHOPSTICK, CORESHELL, JHUHUGIT, and ADVSTORESHELL.[23]
The name "Fancy Bear" is derived from the coding system that Dmitri Alperovitch uses for hacker groups. "Bear" indicates that the hackers are from Russia. Fancy refers to "Sofacy", a word in the malware that reminded the analyst who found it, of Iggy Azalea's song "Fancy".[1]
"Fancy Bear" has been operating since the mid-2000s. CrowdStrike reported targeting has included Aerospace, Defense, Energy, Government and the Media industries. "Fancy Bear" intrusions have occurred in United States, Western Europe, Brazil, Canada, China, Republic of Georgia, Iran, Japan, Malaysia and South Korea. Targeted defense ministries and military organizations parallel Russian Federation government interests. This may indicate affiliation with the Main Intelligence Directorate (GRU, a Russian military intelligence service). Specifically, "Fancy Bear" has been linked to intrusions into the German Bundestag and France’s TV5 Monde (television station) in April 2015. SecureWorks, a cybersecurity firm headquartered in the United States, concluded that from March 2015 to May 2016, the "Fancy Bear" target list included not merely the DNC, but tens of thousands of foes of Putin and the Kremlin in the United States, Ukraine, Russia, Georgia, and Syria. Only a handful of Republicans were targeted, however.
Fancy Bear has been known to tailor implants for target environments, for instance reconfiguring them to use local email servers.[86] In August 2015, Kaspersky Lab detected and blocked a version of the ADVSTORESHELL implant that had been used to target defense contractors. An hour and a half following the block, Fancy Bear actors had compiled and delivered a new backdoor for the implant.[23]
Fancy Bear sometimes creates online personas to sow disinformation, deflect blame, and create plausible deniability for their activities.[88]