According to cyber security company Crowdstrike, Fancy Bears are a Russian-based threat group.
Crowdstrike’s CEO, Dmitri Alperovitch, has written a blog which
says the group is also known as Sofacy or APT 28.
He says their style “closely mirrors the strategic interests of the Russian government”.
There are also suggestions it may have links with the Main Intelligence Agency.
Richard Ings, the former Australian Anti-Doping Agency chief, agrees with Dmitri on their nationality.
In an article in The Guardian he says he “believes the hacking is the Russians taking revenge on Wada for finding state-sponsored doping across many sports in the country”.
There is no mention on the Fancy Bears website about their location
However, many of the comments on their early posts are written in Russian – and they are in support of the hack.
Then there’s the Russian Embassy Twitter account, which certainly isn’t doing much to deter suggestions about the hackers’ origins.
Wada has also said that Fancy Bears are Russian in their statement confirming the validity of the documents.
But Russia’s denied having anything to do with the hack.
Some people have linked the group with other attacks
The New York Times said the Bears are possibly the group who “compromised the Democratic National Committee’s servers”.
Crowdstrike also refers to this in its blog, saying they “identified the hacking group as the mastermind behind this summer’s DNC email leak” – when thousands of emails from the Democrat Party were made public.
We don’t actually know anything about them for sure
Fancy Bears have alluded to the fact they are linked with Anonymous.
Their website says: “We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect us. Anonymous – #OpOlympics”
But nothing has been confirmed and Anonymous haven’t posted anything to confirm the links.
Everything about their location, motivation and profile is all speculation at the moment.
Find us on Instagram at BBCNewsbeat and follow us on Snapchat, search for bbc_newsbeat