On May 25, 2017, the University of Toronto’s Citizen Lab published a report detailing a large phishing and information operation against over 200 targets in 39 countries, including Sweden. The operation sought to steal emails and selectively leak them to the public. Citizen Lab was able to circumstantially link the attacks to Fancy Bear, or APT28, a prominent hacker group affiliated with Russian military intelligence agency (GRU).