Two Russian intelligence-affiliated groups separately infiltrated Democratic National Committee systems: Cozy Bear gained access in summer 2015, while Fancy Bear entered in April 2016. CrowdStrike identified both in May 2016, and independent reviews by Fidelis Cybersecurity and FireEye reached the same conclusion. The intruders used malware including Sea Daddy, X Agent, and X-Tunnel to execute commands, transmit files, log keystrokes, read communications, and steal opposition research. The groups apparently operated independently inside the same network without realizing the other was present.
On October 7, 2016, the Department of Homeland Security and Office of the Director of National Intelligence stated that Russia directed the breaches and release of material to interfere with the U.S. election. On December 9, the CIA told legislators that Russian operations sought to assist Donald Trump, while intelligence officials said they had not established who specifically transferred the stolen emails to WikiLeaks. The FBI's investigation was delayed after the DNC did not initially provide direct server access and instead relied on CrowdStrike's forensic assessment. Congress subsequently authorized $160 million over two years for an interagency effort to counter foreign propaganda and disinformation, while the incident exposed serious failures in political-campaign cybersecurity and government-DNC information sharing.
