From 1996 through 1998, attackers conducted a sustained intrusion campaign against NASA, the Pentagon, the U.S. Department of Energy, military contractors, civilian academics, and other government agencies. Investigators said the stolen material may have included naval codes, missile-guidance information, military maps, troop configurations, hardware designs, encryption techniques, and Pentagon war-planning data. One widely repeated estimate claimed that printing all the exfiltrated files would create a stack three times the 555-foot Washington Monument, although the source does not provide an independently documented measurement.
The attackers exploited known vulnerabilities that institutions often left unpatched for six months to a year, routing connections through compromised universities, libraries, and other systems to obscure their origin. U.S. investigators blamed Russia, but the early public case rested largely on a Russian IP address and was not supported by strong evidence in the supplied account. By the end of 1999, a 40-person task force drawn from law enforcement, the military, and government agencies was investigating the breach. Later researchers associated Moonlight Maze code with the Turla threat actor through analysis of a 1998 proxy server, but that attribution is presented as a later research finding rather than a government-confirmed conclusion.
