The Netherlands’ Joint Sigint Cyber Unit, in the summer of 2014, seems to have found the den of “Cozy Bear,” as the state-sponsored group came to be known (also APT29) after the DNC hack in 2016. JSCU infiltrated its network and a nearby security camera, allowing it to see what Cozy Bear was up to, and possibly who was a member.
I tend to eyeroll at “exactly like a William Gibson novel”, but the Dutch hacking the camera in the corridor of Cozy Bear’s Moscow Square building...— William Gibson (@GreatDismal) January 26, 2018