Democratic National Committee cyber attacks

Forensic evidence analyzed by several cybersecurity firms, CrowdStrike, Fidelis, and Mandiant (or FireEye), strongly indicated that two Russian intelligence agencies separately infiltrated the DNC computer systems.

[2][3][4][5][6] On December 9, 2016, the CIA told U.S. legislators that the U.S. Intelligence Community had concluded Russia conducted the cyberattacks and other operations during the 2016 U.S. election to assist Donald Trump in winning the presidency.

The groups were presumed to have been spying on communications, stealing opposition research on Donald Trump, as well as reading all email and chats.

[11] However, cybersecurity experts and firms, including CrowdStrike, Fidelis Cybersecurity, Mandiant, SecureWorks, ThreatConnect, and the editor for Ars Technica, have rejected the claims of "Guccifer 2.0" and have determined, on the basis of substantial evidence, that the cyberattacks were committed by two Russian state-sponsored groups (Cozy Bear and Fancy Bear).

[12] According to separate reports in The New York Times and The Washington Post, U.S. intelligence agencies have concluded with "high confidence"[13] that the Russian government was behind the theft of emails and documents from the DNC.

[16] In a joint statement on October 7, 2016, the United States Department of Homeland Security and the Office of the Director of National Intelligence stated that the US intelligence community is confident that the Russian government directed the breaches and the release of the obtained material in an attempt to "… interfere with the US election process.

[3][5][20] This intrusion was part of several attacks attempting to access information from American political organizations, including the 2016 U.S. presidential campaigns.

[citation needed] "Cozy Bear" has in the past year infiltrated unclassified computer systems of the White House, the U.S. State Department, and the U.S. Joint Chiefs of Staff.

According to CrowdStrike, other targeted sectors include: Defense, Energy, Mining, Financial, Insurance, Legal, Manufacturing, Media, Think tanks, Pharmaceutical, Research and Technology industries as well as universities.

"Cozy Bear" observed attacks have occurred in Western Europe, Brazil, China, Japan, Mexico, New Zealand, South Korea, Turkey and Central Asia.

"Fancy Bear" intrusions have occurred in United States, Western Europe, Brazil, Canada, China, Republic of Georgia, Iran, Japan, Malaysia and South Korea.

Specifically, "Fancy Bear" has been linked to intrusions into the German Bundestag and France's TV5 Monde (television station) in April 2015.

[22] On January 25, 2018, Dutch newspaper de Volkskrant and TV program Nieuwsuur reported that in 2014 and 2015, the Dutch Intelligence agency General Intelligence and Security Service (AIVD) had successfully infiltrated the computers of Cozy Bear and observed the hacking of the head office of the State Department and subsequently the White House, as well as the Democratic Party, and were the first to alert the National Security Agency about the cyber-intrusion.

[5][20][27] "Cozy Bear" employed the "Sea Daddy" implant and an obfuscated PowerShell script as a backdoor, launching malicious code at various times and in various DNC systems.

Its chief technology officer, Dmitri Alperovitch, who is also a cybersecurity expert, stated: CrowdStrike stands fully by its analysis and findings identifying two separate Russian intelligence-affiliated adversaries present in the DNC network in May 2016[...] We've had lots of experience with both of these actors attempting to target our customers in the past and know them well.

[36][37] The U.S. Intelligence Community tasked resources debating why Putin chose summer 2016 to escalate active measures influencing U.S.

[38] On December 9, 2016, the CIA told U.S. legislators the U.S. Intelligence Community concluded Russia conducted operations during the 2016 U.S. election to assist Donald Trump in winning the presidency.

[7][40][41] Multiple U.S. intelligence agencies concluded people with specific individuals tied to the Russian government gave WikiLeaks hacked emails from the Democratic National Committee (D.N.C.)

[7] A senior law enforcement official told CNN: The FBI repeatedly stressed to DNC officials the necessity of obtaining direct access to servers and data, only to be rebuffed until well after the initial compromise had been mitigated...These actions caused significant delays and inhibited the FBI from addressing the intrusion earlier.

[42] Members of the U.S. Senate Intelligence Committee traveled to Ukraine and Poland in 2016 and learned about Russian operations to influence their affairs.

Senator Angus King told the Portland Press Herald that tactics used by Russia during the 2016 U.S. election were analogous to those used against other countries.

[48] On December 9, 2016, President Obama ordered the entire United States Intelligence Community to conduct an investigation into Russia's attempts to influence the 2016 U.S. election — and provide a report before he left office on January 20, 2017.