fancy bear employs advanced methods consistent with the capabilities of state actors. they use spear phishing emails, malware drop websites disguised as news sources, and zero-day vulnerabilities. one cybersecurity research group noted their use of no less than six different zero-day exploits in 2015, a considerable technical feat that would require large numbers of programmers seeking out previously unknown vulnerabilities in top of the line commercial software. this is a sign that fancy bear is a state-run program and not a gang or a lone hacker.