fancy bear has been known to tailor implants for target environments, for instance reconfiguring them to use local email servers. in august 2015, kaspersky lab detected and blocked a version of the advstoreshell implant that had been used to target defense contractors. an hour and a half following the block, fancy bear actors had compiled and delivered a new backdoor for the implant.