@JaapTitulaer @bleidl @Dust_Off70 while we're reviewing, Symantec's technical commentary on SeaDaddy implant (identified by Crowdstrike as CozyBear) community.broadcom.com/symantecenterp… says that one of its optional payloads can carry out "email extraction from MS Exchange Server" - a skill never mentioned for XAgent, XTunnel 
@JaapTitulaer @bleidl @Dust_Off70 2/ as we've discussed, Mueller's analysis of progress onto MS Exchange Server by Fancy Bear was arm-waving at best and Henry's testimony appears to refute any belief that Crowdstrike may have observed exfiltration of emails. So here's a very narrow question:
@JaapTitulaer @bleidl @Dust_Off70 3/ even if one believes that either CozyBear or FancyBear exfiltrated emails, can one show that they were exfiltrated by Fancy Bear, rather than Cozy Bear? I suppose that the argument would be that Cozy Bear had been in the system all along, whereas Fancy Bear had just arrived.
@JaapTitulaer @bleidl @Dust_Off70 4/ but direct evidence that it was Fancy Bear (as opposed to Cozy Bear) seems non-existent or even, based on techniques, the other way around.
@JaapTitulaer @bleidl @Dust_Off70 5/ there's also the very odd situation where Cozy Bear hacking had been infiltrated and perhaps even directed by Dokuchaev and Mikhailov, who have been convicted in Russia of accepting US money and being US agents. They would have incentive to plant evidence against Fancy Bear.
@JaapTitulaer @bleidl @Dust_Off70 6/ technical information seems very inconclusive. Mueller indictment additionally relied on information about searches and Bitcoin associations, but didn't show their hand on how this data connected to named GRU officials.
