'I've seen what they could do'



It's not just whom the hackers tried to spy on that points to the Russian government.



It's when.



Maria Titizian, an Armenian journalist, immediately found significance in the date she was targeted: June 26, 2015.



"It was Electric Yerevan," she said, referring to protests over rising energy bills that she reported on. The protests that rocked Armenia's capital that summer were initially seen by some in Moscow as a threat to Russian influence.



Titizian said her outspoken criticism of the Kremlin's "colonial attitude" toward Armenia could have made her a target.



Eliot Higgins, whose open source journalism site Bellingcat repeatedly crops up on the target list, said the phishing attempts seemed to begin "once we started really making strong statements about MH17," the Malaysian airliner shot out of the sky over eastern Ukraine in 2014, killing 298 people. Bellingcat played a key role in marshaling the evidence that the plane was destroyed by a Russian missile — Moscow's denials notwithstanding.



The clearest timing for a hacking attempt may have been that of Adrian Chen.



On June 2, 2015, Chen published a prescient expose of the Internet Research Agency, the Russian "troll factory" that won fresh infamy in October over revelations that it had manufactured make-believe Americans to pollute social media with toxic rhetoric.



Eight days after Chen published his big story, Fancy Bear tried to break into his account.



Chen, who has regularly written about the darker recesses of the internet, said having a lifetime of private messages exposed to the internet could be devastating.



"I've covered a lot of these leaks," he said. "I've seen what they could do."