Crowdstrike also concluded that the attacks had been carried out independently of each other — meaning the FSB and GRU had essentially been each other’s rivals. But Crowdstrike founder Dmitry Alperovich didn’t answer the Bell’s question how his company was able to distinguish between hackers working for the FSB and those employed by the GRU.

The Bell doesn’t know whether Mikhailov could have helped Alperovich reach that conclusion. But according to a source close to one of the defendants, Mikhailov passed on the information to Crowdstrike through an intermediary. The Bell could not confirm this claim.

Аs part of his job, Mikhailov had direct contact with foreign intelligence agencies and private cyber-security companies. Unlike many other law enforcement and intelligence services officials known in Russian as siloviki, he had been free to participate in various cyber-security conferences and events, two of his acquaintances said.

Two of Mikhailov’s acquaintances say he shared information about Russian financially motivated hackers with his foreign counterparts. One source claims that Mikhailov did so on as many as 10 separate occasions — with Stoyanov, an old friend, often acting as an intermediary.

Many Russian hackers follow an unspoken rule not to engage in criminal activity “at home” in order to not give Russian authorities a pretext to detain them. At the same time, Russia is generally unwilling to extradite hackers. Mikhailov and Stoyanov would help foreign intelligence agencies with information in precisely such cases, the sources said.

Some cases of such cooperation are known: for example FSB’s TsIB department, where Mikhailov worked, and the FBI worked together on the case against Roman Seleznev, the son of a State Duma deputy who is now serving a 27-year sentence in the U.S. for hacking into bank accounts. This is recorded in court documents in the case against Seleznev.

А tail was put on Mikhailov and his group by Russian intelligence around April, one of the sources close to them said. Another source close to a highly placed U.S. intelligence official confirmed that claim.

According to the Crowdstrike report, a second attack on the DNC took place in March. Eight months later, Mikhailov and his group were detained. And several weeks after that, right before the New Year, the outgoing Barack Obama administration leveled new sanctions against Russia. This time, they weren’t connected to Russian meddling in Ukraine.