network security firm fireeye released a detailed report on fancy bear in october 2014. the report designated the group as "advanced persistent threat 28" (apt28) and described how the hacking group used zero-day exploits of the microsoft windows operating system and adobe flash. the report found operational details indicating that the source is a "government sponsor based in moscow". evidence collected by fireeye suggested that fancy bear's malware was compiled primarily in a russian-language build environment and occurred mainly during work hours paralleling moscow's time zone. fireeye director of threat intelligence laura galante referred to the group's activities as "state espionage" and said that targets also include "media or influencers."