federal elections. Stolen documents included internal strategy documents, fundraising data, opposition research, and emails from the work inboxes of DNC 130 employees. The GRU began stealing DCCC data shortly after it gained access to the network. On April 14, 2016 (approximately three days after the initial intrusion) GRU officers downloaded rar.exe onto the DCCC’s document server. The following day, the GRU searched one compromised DCCC computer for files containing search terms that included “Hillary,” “DNC,” “Cruz,” and 131 “Trump.” On April 25, 2016, the GRU collected and compressed PDF and Microsoft documents from folders on the DCCC’s shared file server that 132 pertained to the 2016 election. The GRU appears to have compressed and 133 exfiltrated over 70 gigabytes of data from this file server. The GRU also stole documents from the DNC network shortly after gaining access. On April 22, 2016, the GRU copied files from the DNC network to GRU-controlled computers. Stolen documents included the DNC’s opposition 134 research into candidate Trump. Between approximately May 25, 2016 and June 1, 2016, GRU officers accessed the DNC’s mail server from a GRU- 135 controlled computer leased inside the United States. During these connections, Unit 26165 officers appear to have stolen thousands of emails and 136 attachments, which were later released by WikiLeaks in July 2016. B. Dissemination of the Hacked Materials The GRU’s operations extended beyond stealing materials, and included releasing documents stolen from the Clinton Campaign and its supporters. The GRU carried out the anonymous release through two fictitious online personas that it created—DCLeaks and Guccifer 2.0—and later through the organization WikiLeaks. 1. DCLeaks The GRU began planning the releases at least as early as April 19, 2016, when Unit 26165 registered the domain dcleaks.com through a service that 137 anonymized the registrant. Unit 26165 paid for the registration using a pool 138 of bitcoin that it had mined. The dcleaks.com landing page pointed to
Mueller Report PDF Page 57 Page 59