software that fancy bear has used includes advstoreshell, chopstick, jhuhugit, and xtunnel. fancy bear utilises a number of implants, including foozer, winids, x-agent, x-tunnel, sofacy, and downrange droppers. based on compile times, fireeye concluded that fancy bear has consistently updated their malware since 2007. to avert detection, fancy bear returns to the environment to switch their implants, changes its command and control channels, and modifies its persistent methods. the threat group implements counter-analysis techniques to obfuscate their code. they add junk data to encoded strings, making decoding difficult without the junk removal algorithm. fancy bear takes measures to prevent forensic analysis of its hacks, resetting the timestamps on files and periodically clearing the event logs.