a lieutenant colonel major saw a unit within 26165, including development of malware, including a tool used by the gru known as x agent. concerning who and when and what and where they developed this tool for use is reporter: the indictment identifies another hacking tool called x tunnel, it pinpoints certain russians hacks. they used it to hide their tracks. american investigators even knew who the russians were googling, even cyber search terms. threat connect which helps identify russian hackers such as goo goocifer 2.0.