Guccifer 2.0
Guccifer 2.0 was an online persona used during the 2016 U.S. election-related intrusions and leaks involving Democratic targets. The content states that Russian intelligence officers apparently adopted the Guccifer 2.0 guise, and that the GRU created and deployed the persona to undercut attribution of the attacks to Russia and to promote and disseminate stolen data. Multiple cited articles and summaries describe Guccifer 2.0 as a likely Russian front or deception/disinformation persona rather than an independent Romanian hacker. The persona publicly claimed responsibility for hacking the Democratic National Committee (DNC), and was also associated with leaks from the Democratic Congressional Campaign Committee (DCCC) and claims of hacking the Clinton Foundation. Guccifer 2.0 published stolen Democratic documents online, shared material with media outlets, and was reported to have provided files to WikiLeaks. The content also references direct messages between Guccifer 2.0 and WikiLeaks, and states that Russian operators used personas including Guccifer 2.0 to work with organizations in a position to spread the stolen information, including WikiLeaks. Targets directly mentioned in the content include the DNC, DCCC, Democratic Party organizations, and purportedly the Clinton Foundation. Released material included opposition research on Donald Trump, political strategy and fundraising documents, convention planning files, donor and volunteer information, passwords, and private contact information. Tactics and tradecraft directly mentioned in the content include use of a fabricated online persona for false-flag/deception purposes, publication and dissemination of stolen documents, use of blogs and social media accounts, and coordination with amplifying outlets. Reporting cited in the content also notes forensic indicators in leaked documents that pointed toward Russian involvement, including Russian-language settings, Cyrillic metadata, and the username "Iron Felix." The content further references malware and intrusion activity at the DNC linked by security firms to Russian-associated groups COZY BEAR and FANCY BEAR, while Guccifer 2.0 emerged as a cover identity after public attribution. Known alias in the provided content: Guccifer 2.0.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Discussed as a persona associated with the DNC leak; the content indicates analysis aimed at attributing this activity to Russia.
Guccifer 2.0 is described as the moniker used by suspected Russian intelligence operatives involved in disseminating hacked Democratic Party emails and communicating directly with WikiLeaks.
Persona tied in the article to the hacking and release pipeline around Democratic Party emails during the 2016 US election.
Described as a purported hacker moniker that published extensive personal information obtained through hacking and shared links on Twitter.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.