[Ed. – Note that these hackers are a different set from “Fancy Bear,” which was thought to be operated by the Russian FSB, or follow-on to the KGB. Fancy Bear is the APT that was first noted on the DNC system in April 2016. Cozy Bear is a different “advanced persistent threat” group; apparently — according to the Dutch — confirmed to be operating from the Russian Foreign Intelligence Service, or SVR. The SVR’s charter is foreign surveillance; the FSB’s larger charter, like the KGB’s, includes domestic security.]
Dutch intelligence services had eyes and ears for years on the Russian outfit that hacked the Democratic National Committee, even infiltrating a surveillance camera at the Cozy Bear headquarters and recording hackers’ faces, Dutch media reported. …
According to the Dutch media report, Dutch intelligence agency AIVD first hacked into Cozy Bear, situated in a university building next to Moscow’s Red Square, in summer 2014. About 10 hackers were there at any given time, and the Dutch hacked into a security camera showing who entered and exited the room. Pictures were taken of all visitors; these were compared to images of known spies.
In November 2014, the Volkskrant report said, Dutch intelligence were watching as the Russian hackers geared up for their cyberattack on the State Department.