The hacker who stole emails from the Democratic National Committee was identified Thursday as a member of Russia’s elite GRU intelligence agency, according to a Daily Beast report.

Known as Guccifer 2.0, the hacker claimed he was from Romania and had no connection to the Kremlin when he passed DNC emails to WikiLeaks months before the 2016 election.

But a single slip-up, when he failed to activate his VPN client before logging on, left an IP address on a server in France, which U.S. investigators traced back to the GRU’s headquarters on Grizodubovoy Street, Moscow.

Officials have reportedly identified the particular GRU officer who is responsible, but the Daily Beast’s sources didn’t name them.

The sources did say the U.S. investigation into Guccifer 2.0 had been taken over by special counsel Robert Mueller, a move sure to rattle Trump campaign staff.

That Russia interfered in the U.S. election is widely accepted, and there is growing evidence that some members of Trump’s campaign team had contact with people linked to the Kremlin ahead of the vote. However, confirmation of the long-held suspicion of U.S. intelligence officials that Guccifer 2.0 is a Russian spy brings the notion of collusion into sharper relief.

Trump and his allies have consistently disputed the claim that Moscow was behind the DNC hack, particularly Roger Stone, a member of Trump’s inner circle, who claimed to be in contact with the hacker during the campaign. Stone even released chat messages he exchanged with Guccifer 2.0 last year, in an attempt to debunk claims of a Kremlin link.

Stone was already reportedly in Mueller’s crosshairs before it came to light Thursday that he was admittedly in contact with a Russian intelligence agent during the campaign.

On Friday morning, Trump again tweeted a denial of collusion between Russia and his campaign:

Earlier this month Mueller signaled his intention to go after Moscow’s agents when he charged 13 Russians tied to the Internet Research Agency, known as the “Troll Factory,” with a conspiracy “for the purpose of interfering with the U.S. political and electoral processes, including the presidential election of 2016.”