Loading story…
France has publicly attributed the 2017 hack-and-leak operation against Emmanuel Macron’s presidential campaign to APT28, the GRU-linked group also known as Fancy Bear, marking its first formal accusation over the incident. French officials said the operation stole thousands of campaign emails and documents and released them shortly before the presidential runoff, part of a broader pattern of Russian cyber activity that Paris says has also targeted French media, public services, economic sectors, and organizations tied to the Olympic Games. Earlier reporting said U.S. intelligence had warned France about suspected Russian election hacking ahead of the leak, while researchers at the time pointed to indicators consistent with Moscow-linked operations but stopped short of definitive attribution.
The leak was amplified online through 4chan, Twitter/X, WikiLeaks, bots, and U.S. far-right activists backing Marine Le Pen, while French authorities and election regulators urged media and voters not to spread the material during the campaign blackout. Macron’s team said genuine files were mixed with forged or decoy documents, and French officials warned that fake news had been inserted to distort the vote. Analysts later assessed that the operation failed to significantly sway the election because French institutions had prepared for cyber-enabled interference, media outlets limited republication of the dump, and public messaging shifted attention from the leaked files to the attempted information warfare campaign itself.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
France publicly stated for the first time that Russia's GRU-linked APT28 group was responsible for the 2017 cyberattack on Emmanuel Macron's presidential campaign. The foreign ministry condemned Russia's use of APT28 and linked the group to a broader pattern of targeting French interests.
A later analysis argued that the 2017 Macron leaks resembled prior information warfare tactics but failed because French authorities and the Macron campaign anticipated the threat and reduced the credibility of the stolen material. The campaign's claim that some documents were forged helped shift attention from the contents to the attack itself.
Flashpoint said it assessed with moderate confidence that the hacking and leaking of Emmanuel Macron's campaign emails was tied to Fancy Bear/APT28, citing phishing activity, malware reporting, and the broader pattern of Russian targeting of Western elections. The assessment noted suggestive Russian-language metadata but cautioned that such artifacts could have been forged and were not conclusive proof.
NSA Director Mike Rogers said the United States had warned France about Russian hacking threats before the Macron-related leak. He did not directly attribute the incident to Moscow, though researchers had already raised suspicions of Russian involvement.
The hack-and-leak campaign failed to significantly influence the outcome of the French presidential election, according to later analyses. French institutional preparation, media restraint, and public messaging helped blunt the effect of the release.
American far-right activists, bots, WikiLeaks, and coordinated online communities amplified the leaked materials and related anti-Macron narratives across Twitter, 4chan, and Discord. French media largely refrained from reporting the contents because of electoral restrictions, limiting the operation's immediate impact.
France's election campaign commission said the leaked data appeared to come from Macron campaign systems and warned that fake news was likely mixed into the release. It urged media outlets and the public not to publish or relay the documents during the legally mandated campaign blackout before the vote.
Macron's team said the operation was a massive, coordinated hack affecting staff members' personal and professional accounts and campaign records. It also stated that genuine files had been mixed with falsified or decoy documents to sow confusion and disinformation.
Thousands of internal emails and documents from Macron's campaign were stolen and released online about 36 hours before the presidential runoff. The dump was circulated through links posted on 4chan and quickly spread under the hashtag #MacronLeaks.
Before the final leak, Emmanuel Macron's campaign said it had already been targeted by suspected Russia-linked hackers and that earlier intrusion attempts had been blocked. These warnings formed part of the broader concern over election interference.
Ahead of the 2017 presidential election, French authorities warned political parties about cyber-enabled interference risks and put response mechanisms in place based on lessons from earlier foreign election meddling cases. U.S. intelligence also shared warnings and lessons with France and other European allies amid fears of Russian hacking.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcecsis.org
Open sourcecyberscoop.com
Open sourcepolitico.com
Open sourcenytimes.com
Open sourcefoxnews.com
Open sourcewashingtonpost.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian government-linked hackers penetrated the Democratic National Committee, stole opposition research on Donald Trump and thousands of internal emails, and triggered a wider investigation after leaked material exposed not only politically damaging correspondence but also sensitive donor and personal data. Security firms including CrowdStrike, Mandiant, Fidelis, SecureWorks, and ThreatConnect tied the intrusion to Russian groups tracked as `APT28`/**Fancy Bear** and `APT29`, with later reporting pointing specifically to Russia’s military intelligence service, the **GRU**, based on malware and infrastructure overlaps. Researchers and investigators said the operation combined network intrusion, theft, and staged disclosure in a manner consistent with a coordinated influence campaign targeting the 2016 U.S. election. After the breach became public, the online persona **Guccifer 2.0** surfaced to claim responsibility and deny Russian involvement, but reporting and forensic analysis described the persona as a likely cutout used to distribute stolen documents and muddy attribution. WikiLeaks then published large batches of DNC emails while later reports said it had direct outreach to Donald Trump Jr. during the campaign and declined to publish a separate cache of Russian government documents in the same period, intensifying scrutiny of its role in the broader information operation. Subsequent congressional and special-counsel-era reporting found sharp partisan disagreement over whether Trump associates coordinated with Russia, but broad agreement that Moscow conducted an interference campaign that used hacked Democratic materials to damage Hillary Clinton and influence the election.
Jun 29, 2026
A suspected cyberattack disrupted services at **La Poste**, France’s state-owned postal operator, affecting both postal operations and its banking subsidiary, **La Banque Postale**. The incident caused outages across customer-facing systems and internal services, prompting the company to activate response measures while working to restore operations and assess the scope of the intrusion. Two days after the disruption became public, a **pro-Russian hacking group** claimed responsibility for the attack, escalating concerns that the incident may have been politically motivated rather than ordinary cybercrime. French authorities and the company continued investigating the breach and its impact, while the claim added to broader worries about hostile cyber activity targeting critical national services in France.
Jul 12, 2026
U.S. officials, cybersecurity investigators, and later federal prosecutors concluded that Russian intelligence penetrated Democratic Party networks and stole politically sensitive material during the 2016 presidential campaign. Early reporting on the Democratic National Committee breach tied the intrusion to the Russian-linked groups **Cozy Bear** and **Fancy Bear**, while the online persona **Guccifer 2.0** surfaced to claim responsibility and distribute stolen files, including opposition research on Donald Trump. As hacked emails from the DNC and Clinton campaign chairman John Podesta were published, U.S. officials said they saw increasing evidence that Russia was using **WikiLeaks** as a channel to disseminate the material, even as Moscow, WikiLeaks, and figures including Julian Assange publicly denied Russian involvement or coordination. The U.S. response escalated from an FBI investigation and intelligence reviews ordered by the Obama administration to formal attribution and criminal charges. Special Counsel Robert Mueller later secured indictments against **12 GRU officers** for the DNC hack-and-leak operation, and court filings and subsequent reporting detailed contacts between Guccifer 2.0 and Trump adviser Roger Stone, though Mueller said he lacked sufficient admissible evidence to charge Stone, Assange, or WikiLeaks in a broader conspiracy. A bipartisan Senate Intelligence Committee report later backed the intelligence community’s assessment that the interference campaign was approved by **Vladimir Putin**, combined cyber-espionage with influence operations, and was intended to damage Hillary Clinton and help Donald Trump.
Jun 29, 2026