Solarwind, Fireeye, Microsoft and Cisco leaks are offered for sale 6 years ago
a nice bonus on top of the government hacker salary.
The current narrative is that they aren't on payroll or under orders, but instead individuals or groups within the collective (cozy bear) act on their own initiative to win putin's favor.