France finally blamed Russia for 2017 MacronLeaks: why the delay?

After many years of investigations, the French diplomacy finally accused Russia of being responsible for the hacking of Emmanuel Macron’s 2017 campaign, although the evidence was provided in real time by Bivol, an investigative website partner of EUalive.

As the French daily Le Monde announced yesterday (29 April), the Russian military intelligence (GRU) is identified as having fomented cyberattacks against French interests, including the sabotage of the TV5Monde channel in 2015, which caused the French television channel to be paralysed, and the hacking of emails belonging to Emmanuel Macron’s team during the 2017 presidential campaign.

The so-called MacronLeaks of 2017 refer to a cyberattack and subsequent leak of over 20,000 emails and documents from Emmanuel Macron’s presidential campaign, published online on 5 May 2017, just two days before the French presidential election’s second round. The incident, widely seen as an attempt to disrupt Macron’s campaign against far-right candidate Marine Le Pen, involved a mix of authentic and fabricated documents, amplified by social media bots and far-right activists.

“The Russian military intelligence service (GRU) has been deploying a cyber-offensive modus operandi called APT28 against France for several years,” said Jean-Noël Barrot, head of French diplomacy, in a message posted on X, thus officially attributing these cyberattacks to the GRU for the first time.

APT28, acronym for Advanced Persistent Threat, is a Russian actor well-known to the United States and European Union countries, which have already imposed sanctions on individuals or entities linked to this group, which, according to these countries, attempts to destabilize public opinion.

According to Le Monde, faced with the growing intensification of the Russian hybrid threat, France has decided to make public its latest investigations, compiled in a report by the French National Agency for the Security of Information Systems (ANSSI), which details attacks that occurred between 2021 and the end of 2024. The previous report was published in October 2023.

“Since 2021, APT28 has targeted a wide range of agencies: ministerial entities, local authorities, but also companies in the arms and aerospace industries, as well as economic and financial sectors,” French authorities explain in a video intended to raise awareness of this threat, published by Jean-Noël Barrot on his X account.

The announcements sound weird, because the are based on evidence made already public in 2017.

On 9 May 2017 the website Le Parisien reported that the cyberintelligence firm Flashpoint claimed that APT 28 was behind the attack aiming at Macron. Another security firm, Proofpoint, interviewed by The Guardian, suspected already back then Russian maneuvering: “Certain metadata clearly indicates that certain documents, such as those on the ‘Bahamian bank accounts’ were edited on computers with Russian-language operating systems.” These documents were also leaked online last week.

Russian traces were quickly found in the “MacronLeaks.” Several sources, including American security analyst Michael Horowitz and the independent Bulgarian media outlet Bivol, identified names written in Cyrillic in the metadata of the documents that emerged two days before the 2017 election. The name “Roshka Georgiy Petrovich” appears no fewer than nine times. It belongs to a representative of Eureka, a Moscow-based IT solutions provider. Its clients included several Russian government organizations.

Atanas Chobanov, editor of the investigative websites Bivol and Bird, told EUalive that he and his colleagues “worked all night” to analyse the data from Macronleaks.

“This requires specific data journalism skills. Specifically, we searched for Cyrillic characters in the documents and found Roshka’s name written in Cyrillic in the metadata of several files”, he explained.

In his words, Russia released the so-called MacronLeaks two days before the 2017 presidential election, and rumors immediately spread that it contained data on Macron’s offshore companies and secret accounts. As Chobanov explained, on election day, there was an information blackout in France, but it did not apply to Twitter, where his website published its finding identifying the Russian trail.

“Then our colleagues from Insider clarified the identity of Roshka and categorically linked him to the GRU. It seems that the French services were aware, but nevertheless Macron invited Putin to Versailles and still tried to engage with him”, Chobanov said.

In his opinion, if the French government finally decided to point the finger at Russia, this is because of the aggravated relations with Russia.

“We can connect the dots now. At the time, the press was thundering that MacronLeaks was a Russian operation, but the politicians were looking the other way”, he said.

For much of his presidency, Macron pursued a strategy of engaging Putin, believing diplomacy could bridge divides and integrate Russia into a cooperative European framework. This approach, often viewed as overly optimistic, led to high-profile gestures, such as inviting Putin to Versailles in 2017 and hosting him at Fort de Brégançon in 2019.

Macron’s persistence continued even after Russia’s 2022 invasion of Ukraine, with numerous phone calls aimed at mediation. Critics argued this reflected a naive underestimation of Putin’s authoritarian ambitions. However, mounting evidence of Russia’s hybrid warfare— including cyberattacks like the 2017 MacronLeaks, disinformation campaigns, and aggression in Ukraine—has dismantled this illusion. France’s recent public accusations against Russia, particularly implicating the GRU in cyberattacks, signal Macron’s acknowledgment that engagement has failed, marking a pivot toward a harder stance against Moscow.