The GRU is used for both tactical intelligence collection in the battlefield in support of Russian military operations and also strategic active measures or psychological warfare overseas.
Cyber criminals are good... but they cut corners. They don't spend a lot of time tweaking things and making sure that every aspect of the attack is obfuscated.
Transnational organized cybercriminal groups have stolen hundreds of millions of dollars from financial institutions and ordinary citizens.
With Fancy Bear, we have medium-level confidence it's GRU, which is Russia's military intelligence agency, and with Cozy Bear, we have low-level confidence it's FSB, the Russian federal security service.
You have a very large population of hackers in Eastern Europe in general and Russia especially. A lot of them consider themselves patriotic individuals and will take broad direction from government policies.
We've been worried for some time that one of the ways that North Korea can retaliate against further escalation of tensions is via cyber, and particularly attacks against our financial sector. This is something they have really perfected as an art against South Korea.