The Warning: Fancy Bear and the Boston Pattern

by Susan Katz Keating

It wasn’t the bombs that kept bringing me back. It was the warnings.

“It’s an old story,” I said.

“It’s not.” He wasn’t arguing. He was correcting. “The Boston office is working it,” he said, leaning forward. “I’m telling you.”

We had been talking for 20 minutes by then. He never dealt in loose information, and I always listened to him. But he had not given me anything I could use. The Fancy Bear espionage group wasn’t a story. It was a constant. The kind of thing that sits in the background whether you’re looking at it or not.

“Why Boston,” I said. The locale simply didn’t fit. If this were a revived investigation, I would have thought it was run out of Washington or New York. Boston didn’t make sense for the site of an operation involving Russian military intelligence. I wanted a document. A case number. Something that converted what he was saying from a claim into a fact I could stand behind. I pushed back, as always.

“Give me a thread I can actually pull.”

He couldn’t. He had the assertion and the certainty behind it, but I couldn’t take it anywhere, even from a contact with his record. I told him to call me when he had something I could use. 

I resumed the work I had come to Boston to do, which was old business that never quite stayed finished. The Tsarnaev case. It had a quality I have encountered previously in long investigations; it was a knot that came loose without anyone ever untying it. It wasn’t the bombs that kept bringing me back. It was the warnings.

The first warning came in 2011. By then, Russia’s Federal Security Service had been watching Chechens across the generations, according to one journalist who spent years in the Caucasus. 

“It tightened after Beslan,” Thomas Goltz told me years ago. “After the school siege, Russia viewed every last Chechen as a bomb waiting to explode.” 

Among them, Tamerlan Tsarnaev.

Russia sent the FBI a detailed written communication about Tsarnaev in 2011, saying he was radicalized and was preparing to travel to the Caucasus. The FBI assessed the tip, found nothing actionable, and closed the case.

Tsarnaev went to Dagestan the following January and stayed six months. The FSB, which maintained intensive surveillance across that territory and had placed him on their own watch list, never reported back. A man they had flagged moved freely through their most volatile region for half a year. Three months after he returned to Boston, the bombs went off on Boylston Street.

Russia did not lose interest in the Boston Chechen community, Goltz told me. 

“They kept watching,” he said. “From their perspective, this was an ongoing security issue.”

I was drawn to the pattern. Russian intelligence maintained a sustained interest in the Boston Chechen community before the bombing, during the investigation, and after the verdict that convicted Dzhokhar Tsarnaev of his role in the Boston Marathon bombing.

Patterns like that do not end. They change form. I wanted to understand what it had evolved into. And so I returned to Boston.

My contact gave me the information I could not document. Then the FBI issued another warning. 

That warning came this year on April 7. It was co-signed by groups like the NSA and 15 partner nations. The advisory named an actor: Russia’s GRU Military Unit 26165. Forest Blizzard. Fancy Bear. 

Since at least 2024, the unit has been exploiting vulnerable home-based routers to build an internet collection network spanning more than 23 states. The owners had no way of knowing. There was no malware to detect, no unusual behavior to observe. The router sat on its shelf and did what it always had done, while everything that traveled its electronic pathways passed first through Russian military intelligence. 

By the time the FBI and DOJ launched Operation Masquerade to sever GRU’s access, the campaign had continued for two years. Fancy Bear had compromised more than 200 organizations, and at least 5,000 consumer devices. It had been running undetected for most of that time.

A router collection network is not a precision instrument. It is by design indiscriminate. You compromise the infrastructure first and filter for targets of interest afterward. The GRU had built a wide pool of compromised devices and then identified, within that pool, traffic related to their specific intelligence priorities. The network was not just reading traffic. It was drawing a map. 

I remembered something Goltz told me years earlier.

“Russia wants to stay on point about men like Shamil Basayev,” who ordered the siege at Beslan, Goltz said. “About men like Tsarnaev.

“It will watch them as closely as it can.”

Did that include via something like Fancy Bear?

I thought about my contact. I thought about what he had told me and what he couldn’t prove and why the Boston field office had been working this. 

I met again with my contact. I told him about the FBI warning.  

“I know,” he said, sitting alongside me on the bench. “I’ve seen it.”

I asked him if the Fancy Bear collection efforts were directed at the Boston Chechen community. 

“Possibly.”

“If they were, is there anything in particular they’re looking for?” 

“Possibly.”

We sat in silence, each of us waiting for the other to add another beat to the conversation. Eventually he checked his watch. He claimed to be late for something, and walked off into the evening. 

A few moments later, I noticed he had left something on the bench. It was a plain manila envelope, sealed with a string wrapped around a button, the kind that carries inter-office mail. I called him on a secure line.

“You forgot something,” I said.

“No I didn’t.”

I glanced at the envelope. I listened another half-beat in silence. “My mistake,” I said.

I disconnected the call. I secured my phone inside my Faraday bag. Then I picked up the envelope.

Crossings in Wartime is Soldier of Fortune’s continuing examination of what moves through the seams of war, where borders weaken, systems falter, and others move in.

Susan Katz Keating is publisher and editor in chief of Soldier of Fortune.