On May 25, 2017, the University of Toronto’s Citizen Lab published a report detailing a large phishing and disinformation campaign against over 200 targets in 39 countries, including senior Ukrainian military and government officials. The operation sought to steal emails and selectively leak them to the public. Citizen Lab was able to circumstantially link the attacks to Russian military intelligency agency (GRU)-connected Fancy Bear, or APT28.