financial resources and expertise for upkeep), combined with its operational security practices and target sets strongly suggests some level of Russian state sponsorship. Its typical work hours (as defined by active operations in networks the group