Fancy Bear
cyber espionage group
Fancy Bear is a Russian cyber espionage group. American cybersecurity firm CrowdStrike has stated with a medium level of confidence that it is associated with the Russian military intelligence agency GRU. The UK's Foreign and Commonwealth Office as well as security firms SecureWorks, ThreatConnect, and Mandiant, have also said the group is sponsored by the Russian government. In 2018, an indictment by the United States Special Counsel identified Fancy Bear as GRU Unit 26165. This refers to its unified Military Unit Number of the Russian army regiments.
Fancy Bear is classified by FireEye as an advanced persistent threat. Among other things, it uses zero-day exploits, spear phishing and malware to compromise targets. The group promotes the political interests of the Russian government, and is known for hacking Democratic National Committee emails to attempt to influence the outcome of the United States 2016 presidential elections.
The name "Fancy Bear" comes from a coding system security researcher Dmitri Alperovitch uses to identify hackers.
Likely operating since the mid-2000s, Fancy Bear's methods are consistent with the capabilities of state actors. The group targets government, military, and security agencies and persons in many countries, often Transcaucasian and NATO-aligned states, but it has also targeted international organizations such as the World Anti-Doping Agency.
“Fancy Bear” enters the record as cyber espionage group. Crown Archives preserves that source wording while asking what Fancy, Bear and cyber can confirm, complicate or overturn.
Why this record matters
“Fancy Bear” is worth following because a concise public description often conceals a longer documentary argument. Here, Fancy, Bear and cyber provides the most credible route into that argument.
The citation trail is more important than the brevity of the summary: it shows where individual claims can be examined in context. The source revision retrieved here is dated Aug 12, 2026. The linked authority identifier is Q20757678. 1 of 1 selected statements include explicit references; 1 carry qualifiers and 0 use preferred rank. The first chronological checks are 2018 and 2016.
A concise general-reference account can conceal disagreements about scope, terminology or the weight assigned to individual sources. The lead is largely declarative, so disagreement and counter-evidence require a deliberate search beyond the opening account. Authority statements aid reconciliation but still require their own references, qualifiers and ranks to be checked.
How to read it
Use the entry as an orientation point, then follow its citations and revision history. Names, dates and institutional relationships should be checked against the original record.
- Subject orientation
- Search vocabulary
- Locating named sources
The closest primary source, responsible institution and strongest cited specialist reference.
Three-step research path
- Establish the record: confirm the title “Fancy Bear”, its source revision and the description used here.
- Expand the search: follow Fancy Bear primary sources, Fancy Bear archive and Fancy research across catalogues and specialist indexes.
- Test the account: compare the strongest cited source with the responsible institution’s current record and note any disagreement.
Questions for further research
- Which source most directly establishes the central claim about “Fancy Bear”?
- What terminology or title could unlock a more precise catalogue search?
- Which institution is responsible for the underlying evidence?
Search terms from this dossier
This entry incorporates text from “Fancy Bear” on English Wikipedia. Contributors are listed in the page history. Text is available under the Creative Commons Attribution-ShareAlike 4.0 License. Selected authority identifiers and statements are retrieved from Wikidata under CC0; their references and qualifiers remain part of the verification path.