in 2011-2012, fancy bear's first-stage malware was the "sofacy" or sourface implant. during 2013, fancy bear added more tools and backdoors, including chopstick, coreshell, jhuhugit, and advstoreshell.