At DNC, COZY BEAR intrusion has been identified going back to summer of 2015, while FANCY BEAR separately breached the network in April 2016.” We deployed our IR team and technology and immediately identified two sophisticated adversaries on the network – COZY BEAR and FANCY BEAR…. To reference, CrowdStrike’s account of their DNC investigation, published on June 14, 2016, “CrowdStrike Services Inc., our Incident Response group, was called by the Democratic National Committee (DNC), the formal governing body for the US Democratic Party, to respond to a suspected breach.

Intelligence community and independent Congressional reports.įollowing a comprehensive investigation that CrowdStrike detailed publicly, the company concluded in May 2016 that two separate Russian intelligence-affiliated adversaries breached the DNC network. Yes, and this is also supported by the U.S. “A lot of - outside of any political organization, companies, most corporations, they often would use these third party contractors, who they hired through their own counsel, and maximize the control from the point of view of the victim.”ĭid CrowdStrike have proof that Russia hacked the DNC? As John Carlin, former Assistant Attorney General for the National Security Division at The Department of Justice, testified before the House Intelligence Committee (cited from page 21 of his testimony):

It is common for organizations to hire third-party industry experts, like CrowdStrike, to investigate and remediate cyber attacks when they suspect a breach even if they are collaborating with law enforcement. The FBI doesn’t perform incident response or network remediation services when organizations need to get back to business after a breach.ĬrowdStrike is a leader in protecting customers around the world from cyber threats. Why did the DNC hire CrowdStrike instead of just working with the FBI to investigate the hack? According to testimony by DNC IT contractor Yared Tamene Wolde-Yohannes, the FBI attributed the breach to the Russian Government in September 2015 (page 7). The DNC was first alerted to the hack by the FBI in September 2015. The DNC contacted CrowdStrike to respond to a suspected cyber attack impacting its network. That remediation process lasted approximately 2-3 days and was completed on June 13, 2016. After conducting this analysis and identifying the adversaries on the network, on Jwe initiated a coordinated remediation event to ensure the intruders were removed and could not regain access. We began our work with the DNC on May 1, 2016, collecting intelligence and analyzing the breach. What was CrowdStrike’s role in investigating the hack of the DNC?ĬrowdStrike was contacted on Apto respond to a suspected breach. Blog update following the release of the testimony by Shawn Henry, CSO and President of CrowdStrike Services, before the House Intelligence Committee that was recently declassified.

Russians hack dnc server