Worth posting twice, lionheart! It's a thorough article.
"Allegations that Fancy Bear works for Russia aren’t new. But raw data has been hard to come by.
"Researchers have been documenting the group’s activities for more than a decade and many have accused it of being an extension of Russia’s intelligence services. The “Fancy Bear” nickname is a none-too-subtle reference to Russia’s national symbol.
"In the wake of the 2016 election, U.S. intelligence agencies publicly endorsed the consensus view, saying what American spooks had long alleged privately: Fancy Bear is a creature of the Kremlin.
"But the U.S. intelligence community provided little proof, and even media-friendly cybersecurity companies typically publish only summaries of their data.
"That makes the Secureworks’ database a key piece of public evidence — all the more remarkable because it’s the result of a careless mistake.
"Secureworks effectively stumbled across it when a researcher began working backward from a server tied to one of Fancy Bear’s signature pieces of malicious software.
...
"The AP validated the list by running it against a sample of phishing emails obtained from people targeted and comparing it to similar rosters gathered independently by other cybersecurity companies, such as Tokyo-based Trend Micro and the Slovakian firm ESET.
"The Secureworks data allowed reporters to determine that more than 95 percent of the malicious links were generated during Moscow office hours — between 9 a.m. and 6 p.m. Monday to Friday."