the name "fancy bear" is derived from the coding system that dmitri alperovitch uses for hacker groups. "bear" indicates that the hackers are from russia. fancy refers to "sofacy", a word in the malware that reminded the analyst who found it, of iggy azalea's song "fancy".