G is for GRU (Fancy Bear) — The Hack-and-Leak, or Stealing to Publish

The Alphabet of Actors — Letter G. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED.

Every actor in this register so far has stolen something in order to keep it. Amesys and Blue Coat and FinFisher stole access to communications, for intelligence. Chengdu 404 stole secrets and money. DarkSide stole the ability to function and ransomed it back. Equation Group hoarded stolen flaws. In each case the value of the theft lay in secrecy — the stolen thing was useful precisely because the victim did not know, or could not stop, its being taken and held.

Russia's military-intelligence hacking apparatus — tracked by the security industry as Fancy Bear, or APT28, and identified by multiple governments as elements of the GRU — inverted that logic, and the inversion is what earns it a letter. The GRU steals in order to publish. The break-in is ordinary espionage; the point of the operation is the release. It takes a target's private communications and makes them public, selectively and at a chosen moment, through personas it invents and channels it exploits, and the target of the operation is not the party whose files were stolen. It is the public those files are shown to.

This is the hack-and-leak, and it is a genuinely different kind of harm from anything in the earlier letters. It is not about reading your secrets. It is about weaponising them — turning a democracy's own openness, its free press and its trust in leaked documents, into the delivery system for a foreign state's manipulation. This is the letter about stealing to publish, and about the most thoroughly exposed actor in this entire register, which is also the one that has been deterred the least.

1. The Actor: a military-intelligence apparatus, tracked by many names

Fancy Bear is a nickname, one of several — APT28, Sofacy, Sednit, Pawn Storm — that different security firms attached to the same intrusion set before governments put their own name to it. That name is the GRU, Russia's military-intelligence directorate, and specifically its cyber units: Military Unit 26165, which does the breaking-in, and Military Unit 74455, which built infrastructure, ran the leak channels, and appears elsewhere in this alphabet under the name Sandworm. The multiplicity of names is itself a feature of the modality — an actor that operates through deniable cut-outs benefits from being hard to name cleanly.

What the industry and successive governments established, with unusual convergence, is that this apparatus conducted a series of hack-and-leak operations against Western democratic targets: the 2016 United States election, the 2017 French election, the World Anti-Doping Agency, and the international investigation into the Salisbury nerve-agent poisoning. The MITRE ATT&CK knowledge base catalogues the activity as G0007; the United States indicted its officers; the United Kingdom, the Netherlands and others attributed and sanctioned it. This dossier treats the GRU attribution as what it is — a high-confidence assessment shared across multiple independent governments and the security industry — while holding the standard line on the individuals: the officers named in the indictments are charged, never tried, and entitled to the presumption of innocence.

The important thing about the actor is not its tradecraft, which is competent but not apex in the Equation Group sense. It is its purpose. This is a military organisation that treats stolen information not as intelligence to be quietly used but as ammunition to be publicly fired, and that reframing of what a hack is for is the whole subject of the letter.

2. The Instrument: the leak, not the breach

The 2016 operation is the canonical case, and its structure is the template. GRU operators broke into the networks of the Democratic National Committee and the Clinton campaign — through, as every such operation begins, spearphishing and stolen credentials — and exfiltrated large volumes of email and internal documents. That part is ordinary espionage; intelligence services steal each other's and their adversaries' communications constantly, and always have. If the GRU had simply read the emails, this would be a routine counterintelligence story and not a letter.

What made it a hack-and-leak was the second act: the release. The stolen material was published, not dumped all at once but staged — released selectively, at politically chosen moments, through vehicles built to obscure its origin. The GRU created a persona, Guccifer 2.0, which claimed to be a lone Romanian hacktivist acting alone, a cover story designed to launder the material's provenance and give journalists a non-state source to cite. It created a website, DCLeaks, as a distribution point. And it fed material to WikiLeaks, which published it to a vast audience under the banner of transparency — the disclosure channel this alphabet examined in its first series, here turned into an amplifier for a foreign intelligence operation.

RAND's analysis of Russian information warfare names this structure precisely, and it is worth quoting because it places the hack-and-leak exactly where it belongs — at the foundation of an industrial pipeline. The disinformation model, RAND writes, begins when 'false or misleading content is created by' various outlets 'and leaks from hackers, such as Fancy Bear (also known as APT28) or Guccifer 2.0. Second, force multipliers, such as trolls and bots, disseminate and amplify this content.' Read that as an assembly line. The hackers manufacture the raw material — authentic stolen documents, the most credible content there is. The persona and the leak site launder it. The troll-and-bot network distributes and frames it. The free press, doing its job, reports it. The instrument is not the breach. The instrument is the entire machine that turns a breach into a narrative.

3. The Manipulation: a lie of emphasis, told with true documents

The most important and most misunderstood feature of the hack-and-leak is that it does not require a single forged word. The manipulation is achieved with authentic material, through control of selection and timing, and understanding that is essential to judging it honestly.

Consider what the operator controls. It controls which stolen documents are released and which are held back, so that the public sees a curated subset chosen to support one narrative. It controls when they are released, so that a damaging disclosure lands at the moment of maximum political effect. It controls the framing, through the personas and the amplification network that tell the audience what the documents 'prove.' And it borrows two kinds of credibility it did not earn: the credibility of a leak, which reads as more authentic and more damning than any public statement precisely because it was stolen, and the credibility of a free press that will report genuinely newsworthy material regardless of who provided it or why.

The result is a lie of emphasis assembled from true parts. Every individual document may be genuine, and the aggregate impression still be a deliberate distortion — the political equivalent of quoting a person accurately but selectively enough to reverse their meaning. This is why the hack-and-leak is so much harder to counter than a simple forgery: you cannot debunk it by proving the documents fake, because they are real. You can only point out the selection and the timing and the laundered origin, which is a far weaker and slower rebuttal than 'this is a forgery,' and which arrives, always, after the impression has already set.

And here the dossier must draw its own bright line, because the temptation to overclaim is strong and the evidence does not support it. That the operation occurred is documented fact. That it changed the outcome of any election is a separate claim, and it is one the evidence does not settle and this dossier does not make. The manipulation lives in the method — the weaponised, selective, laundered release — and the method is condemnable whether or not it swung a single vote. Confusing 'they tried to manipulate the public' with 'they decided the result' is exactly the kind of unearned certainty this series refuses. The first is established. The second is unknowable, and asserting it would itself be a distortion.

4. The Pattern: not a one-off, but a standing capability

If 2016 were isolated, it could be dismissed as an opportunistic stunt. It was not. The same apparatus ran the same play repeatedly, which establishes the hack-and-leak as a deliberate, standing instrument of Russian statecraft rather than a single improvisation.

In 2017, on the eve of the French presidential election, a large cache of material from Emmanuel Macron's campaign was stolen and dumped online — the Macron leaks — in a near-replay of the 2016 template, though French media and law, warned by the American precedent, blunted its effect. The GRU targeted the World Anti-Doping Agency after Russian athletes were sanctioned for state-sponsored doping, stealing and leaking athletes' confidential medical records in an act of retaliatory exposure. And in one of the most revealing episodes of all, documented in the 2020 US indictment held in the LSN archive, GRU officers conducted three spearphishing campaigns in April 2018 against the Organisation for the Prohibition of Chemical Weapons and the UK agencies investigating the Salisbury poisoning — using accounts that mimicked legitimate laboratory email addresses. When an international body was investigating a poisoning that would later be attributed to the GRU, the GRU's hackers tried to break into the investigation, presumably to steal and leak it.

That last case is the tell. The hack-and-leak is not reserved for elections; it is aimed wherever a narrative inconvenient to the Russian state needs to be disrupted, discredited or pre-empted — a doping scandal, a chemical-weapons investigation, a campaign. It is a general-purpose instrument for contesting the information environment, and the GRU keeps it loaded.

5. The Accountability: the most exposed actor, and the least deterred

Here the register reaches its sharpest paradox, and it is worth stating starkly because it inverts the assumption underlying almost everything the first alphabet argued about accountability.

No actor in this series has been exposed more completely than the GRU. The Special Counsel's report laid out the 2016 operation in detail. A 2018 US indictment named twelve GRU officers, with their military units, their ranks, and their specific roles in the intrusion and the leak. In one extraordinary episode, Dutch intelligence physically intercepted four GRU officers in a rented car in the car park beside the OPCW in The Hague, in the act of preparing to hack its Wi-Fi, and then published their names, their passport photographs, the equipment in the car boot, and even a taxi receipt one had kept from a trip past a GRU building in Moscow. Sanctions followed. Diplomatic expulsions followed, in coordinated waves across many countries. If exposure were a deterrent, the GRU would be the most deterred actor on earth.

It is among the least. The hack-and-leak and the broader influence operations did not stop after 2016, or after the indictments, or after The Hague. They continued through 2020 and, per current threat reporting, into the 2024 election cycle. The exposure changed the GRU's behaviour by essentially nothing — and this is the paradox that sharpens the whole register's accountability thesis. For a criminal like DarkSide, exposure is a cost, because it invites disruption and arrest. For a state influence unit, exposure is not necessarily a cost at all, and can be an asset. Part of the point of a hack-and-leak is to be seen to have done it and gotten away with it, because the visible demonstration — a foreign power reached into your election, was caught red-handed, was named and photographed and sanctioned, and simply carried on — is itself corrosive to a democratic society's confidence in its own institutions. Exposure, the thing that deters an ordinary actor, is for the influence actor sometimes the very effect it seeks.

This is Letter Z, the zero-accountability thesis, turned inside out. The first alphabet argued that consequence rarely reaches the powerful actor. The GRU shows something worse: that for one class of actor, even the consequence of total exposure is not felt as a consequence, because being unaccountable in public is the message.

6. The Bridge: the commodity ground floor, and the fabricated future

Every letter carries the actor to what the LSN systems see today, and for the GRU the bridge runs in two directions — down to the humble ground floor the honeypot measures, and forward to a future that removes the operation's last constraint.

Downward first. For all its geopolitical weight, a hack-and-leak begins exactly the way the honeypot's daily traffic begins: with a stolen credential, usually obtained by spearphishing. The GRU did not break into the DNC with some exotic Equation-grade capability; it phished. And phishing and credential theft are precisely what the LSN sensors log at industrial volume — the web-threats classifier tags on the order of 1,011 credential-harvest attempts, the honeypot logs tens of thousands of brute-force sessions. The platform cannot watch Fancy Bear phish a campaign staffer, but it watches the identical technique endlessly, as background radiation, which makes a quiet but important point: the raw material of even a nation-state influence operation is the same cheap credential theft the entire criminal ecosystem runs on. The initial access is a commodity. Only what is done with it is exceptional.

Forward next, and this is where the modality gets worse. The 2016 operation was constrained by a hard requirement: the documents had to be real, which meant they had to be stolen, which limited the operation to what could be exfiltrated and confined the manipulation to selective release. Generative AI dissolves that constraint. A convincing 'leak' can now be fabricated whole — a document, an email, an audio clip, a video that was never stolen because it never existed — and NIST's own generative-AI risk work and the influence-operations literature both flag synthetic media as the accelerant. When the leak need not be real, the theft, always the hard and risky part, becomes optional. And this is exactly where the platform's function matters most, because in a world where a leak may be fabricated, the scarce and essential act is forensic attribution: establishing what was genuine, what was manufactured, who did it, and on what evidence. The register's method — name what the vectors support, flag what is assessment, refuse the unearned claim — is not a stylistic preference in that world. It is the countermeasure.

7. The counter-narrative, steelmanned

The strongest challenge to this letter is not a defence of the GRU but a set of cautions about proportion and hypocrisy, and both deserve a real hearing.

The first caution: every major power runs influence operations, and singling out the GRU risks a double standard. Western intelligence services have interfered in foreign elections, propped up favoured candidates, and run their own information operations for the better part of a century; the CIA's history is not clean, and a register that condemns Russian hack-and-leak while passing over Western equivalents is playing team, not doing forensics. The second caution: the effect of these operations is routinely overstated. The evidence that hack-and-leaks actually change outcomes is thin; societies are more resilient and voters more anchored than the panic suggests; and treating the GRU as an omnipotent puppet-master both flatters it and does its work for it, by amplifying the very sense of compromised institutions the operation seeks to create. On this account, the honest position is to note the operation, decline to inflate it, and hold Western actors to the same standard.

This dossier accepts both cautions and is structured around them — which is why it named the GRU as a Western-facing actor immediately after naming the NSA's Equation Group as a Western one, refusing the team framing; and why it drew the effect-line explicitly, stating that the operation is documented but its determinative impact on any result is not. But acceptance is not surrender, and the cautions have limits. That other powers run influence operations is a reason to examine them too — a task for other letters and other registers — not a reason to fall silent about this one; 'everyone does it' has never been an argument that no one should be named. And that the effect is unproven cuts precisely as this letter has cut it: the manipulation is condemnable as a method regardless of outcome, and refusing to overstate the effect is not the same as excusing the act. The steelman is right that the GRU should not be inflated into a god and should not be judged alone. It is wrong if it concludes that a documented, repeated, state-run operation to weaponise a democracy's openness against itself is not worth naming plainly. It is. Named plainly, and in proportion, is exactly what this letter has tried to do.

8. Verdict — EXPOSED, and UNDETERRED

The GRU took the oldest activity in intelligence — stealing an adversary's communications — and pointed it in a new direction, outward, at the public rather than inward at the analysts. It stole to publish, laundered the theft through invented personas and a transparency channel, timed and framed authentic documents into a narrative, and aimed the whole machine at the one thing a democracy cannot armor without ceasing to be one: its own openness. It did this against an American election, a French election, an anti-doping agency, a chemical-weapons investigation — a standing capability, fired repeatedly, wherever a narrative needed bending.

The verdict's first word is the register's most complete: EXPOSED. No actor here has been named more thoroughly — the report, the indictment with twelve officers and their units, the passports and taxi receipts from The Hague, the sanctions, the expulsions. If naming were the answer, the GRU would be the answered case.

The second word is why naming is not the answer, and it is the darkest finding in either alphabet: UNDETERRED. Total exposure changed the GRU's conduct by nothing, because for a state influence unit exposure is not a cost the way it is for a criminal — it can be a demonstration, a message that a hostile power reached into your institutions, was caught, was named, and carried on regardless. Where DarkSide's exposure invited the disruption that killed its brand, the GRU's exposure fed the exact demoralisation the operation exists to produce. The most-named actor in this register is the least-deterred, and the two facts are not in tension. They are the same fact, seen from the inside of an influence operation, where being seen to act with impunity is not the risk. It is the objective.

The register asked, letter by letter, how consequence attaches to a named actor. The GRU is the case where the question breaks: an actor so exposed that there is nothing left to reveal, and so undeterred that revelation was never a threat. The vectors do not lie — the theft, the leak, the pattern are documented. But the vectors also cannot make an actor care that it has been seen, and against an adversary for whom being seen is part of the plan, the witness's job changes. It is no longer to reveal, because everything is already revealed. It is to keep the record straight — to hold the line between the documented and the assumed, between the real leak and the fabricated one — so that the manipulation, at least, does not get to write the history of itself.

The Alphabet of Actors continues. Verdict: EXPOSED, and UNDETERRED. Confidence: HIGH on the hack-and-leak modality, the operations and the exposure — drawn from RAND's Russian information-warfare analysis, the Mueller report, and the DOJ GRU indictments in the LSN archive, cross-referenced with MITRE G0007. The GRU attribution is stated as high-confidence multi-government and industry assessment; the named officers are charged, never tried, and presumed innocent; and no claim is made that any operation determined an election's outcome, a question the evidence does not settle. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges — and, in a world of manufactured leaks, judging well requires first knowing which leaks were real.