security firm root9b released a report on fancy bear in may 2015 announcing its discovery of a targeted spear phishing attack aimed at financial institutions. the report listed international banking institutions that were targeted, including the united bank for africa, bank of america, td bank, and uae bank. according to the root9b, preparations for the attacks started in june 2014 and the malware used "bore specific signatures that have historically been unique to only one organization, sofacy." security journalist brian krebs questioned the accuracy of root9b's claims, postulating that the attacks had actually originated from nigerian phishers. in june 2015 well respected security researcher claudio guarnieri published a report based on his own investigation of a concurrent sofacy attributed exploit against the german bundestag and credited root9b with having reported, "the same ip address used as command & control server in the attack against bundestag (176.31.112.10)", and went on to say that based on his examination of the bundestag attack, "at least some" indicators contained within root9b's report appeared accurate, including a comparison of the hash of the malware sample from both incidents. root9b later published a technical report comparing claudio's analysis of sofacy attributed malware to their own sample, adding to the veracity of their original report.