DCLeaks launched in June 2016 and presented itself as an American hacktivist project exposing U.S. political decision-making. ThreatConnect and other cybersecurity analysts identified technical and operational links to Fancy Bear, the GRU-linked group also associated with the Guccifer 2.0 persona. The site published emails from senior military and political figures, including former NATO Supreme Allied Commander Philip Breedlove on July 1, 2016, Republican campaign targets on August 12, and 2,576 files from George Soros’s Open Society Foundations on August 15. More than 150,000 emails tied to the Democratic National Committee and Hillary Clinton’s campaign were ultimately distributed through DCLeaks and WikiLeaks.
On July 13, 2018, Deputy Attorney General Rod Rosenstein announced an 11-count federal indictment against 12 GRU officers. Prosecutors alleged that Units 26165 and 74455 created the false-identity DCLeaks site, hacked the DNC, DCCC, Clinton campaign, John Podesta, and state election systems containing data on roughly 500,000 voters, then released material to damage Democratic candidates and disrupt the 2016 election. The indictment also alleged that the operation used mined bitcoin and other obfuscation methods to acquire infrastructure. The case established a formal U.S. criminal attribution, while the accused Russian officers were not brought to trial; an Associated Press report in November 2017 separately found that the FBI had failed to notify most of 312 identified victims.
