The original “Guccifer” (pronounced GUCCI-fer) is a real person: Marcel Lazar Lehel, a Romanian hacker who used the pseudonym Guccifer to hack various accounts belonging to American celebrities and government officials, including members of the Bush family, former Secretary of State Colin L. Powell, and Sidney Blumenthal, an informal adviser to Hillary Clinton.
Mr. Lehel was arrested in Romania in 2014 for hacking the email accounts of several Romanian officials. In April, he was extradited to the United States to face hacking charges and pleaded guilty in May before a federal judge in Alexandria, Va. While awaiting sentencing, Mr. Lehel claimed to have hacked Mrs. Clinton’s private email server, but federal officials have found no evidence to support his claim.
Mr. Lehel is known for his fixation on what conspiracy theorists call the Illuminati, a shadowy group that they believe controls the world. The first Guccifer 2.0 blog post, and messages Guccifer 2.0 sent along with packages of files that same day to the websites Gawker and The Smoking Gun, also denounced the Illuminati.
Other oddities also arose. Technical specialists, scouring metadata on documents posted to Guccifer 2.0’s blog, found some that were last marked by a person with a user name in Cyrillic that appeared to be a nod to Felix E. Dzerzhinksy, best known for establishing the early Soviet secret police forces.
On June 21, Motherboard, an online technology magazine, posted a Twitter chat log of an interview with Guccifer 2.0, in which the person using that account claimed to be Romanian and denied working with the Russian government. Pressed on why Russian language markings showed up in the metadata of the documents he had sent out, Guccifer 2.0 claimed that was just a “watermark.”
“I don’t like Russians and their foreign policy. I hate being attributed to Russia,” Guccifer 2.0 wrote.
During the interview, Motherboard switched from using English to Romanian and to Russian. Guccifer 2.0 claimed not to speak Russian and abruptly cut off the interview.
Motherboard later reported findings of linguistics specialists who said that his Romanian answers did not seem like those of a native speaker, and that the syntax of several of his English lines echoed Russian sentence constructions.
And a linguistic analysis provided to The New York Times by Shlomo Argamon, a chief scientist at Taia’s Global, a cybersecurity firm that has questioned cyberattack attribution claims in the past, also concluded that Guccifer 2 is Russian.
Mr. Argamon, who is a professor of computer science and the director of the master of data science program at the Illinois Institute of Technology, found seven oddities in the hacker’s English text, five of which pointed clearly to Russian as the speaker’s native tongue.
“The linguistic evidence consistently points towards the writer being either a native Russian speaker,” Mr. Argamon said. “It is possible that the writer is a Romanian speaker who has studied Russian. However, the writer denied knowing any Russian, and so the most reasonable conclusion is that he is a Russian native speaker rather than a Romanian native speaker.”
On June 30, Guccifer 2.0 posted additional documents from the Democratic National Commitee’s servers on the WordPress blog. The post again denied Russian links, and spoke admiringly of Julian Assange, the founder of WikiLeaks; Edward J. Snowden, the former intelligence analyst who leaked archives of surveillance documents; and Chelsea Manning, the Army private who sent a huge trove of military and diplomatic documents to WikiLeaks in 2010.
That post accused Mrs. Clinton of being “bought and sold,” in contrast to Mr. Trump, who it said “has earned his money himself. And at least he is sincere in what he says.”
But the post still expressed opposition to Mr. Trump’s ideas “about closing borders and deportation policy.” Of Senator Bernie Sanders of Vermont, the post said, “He never had a chance to win the nomination as the Democratic Party itself stood against him!”
The Hill, a newspaper that covers Congress, reported on July 13 that Guccifer 2.0 had reached out to it and had provided documents about Democratic campaign donors and lobbyists.
It quoted Guccifer 2.0 as saying in an electronic chat, “The press [is] gradually forget[ing] about me, [W]ikileaks is playing for time and [I] have some more docs.” The next day, Guccifer 2.0 posted those documents on the blog. That was the last blog posting.
The Guccifer 2.0 Twitter account posted a few more messages. The most recent one, on July 22, expressed excitement that WikiLeaks had posted the archive of nearly 20,000 Democratic committee emails that “I’d given them!!!”
Since then, that account has fallen silent, too. No messages were posted even as the Democratic Party chairwoman, Representative Debbie Wasserman Schultz, resigned and Mrs. Clinton’s campaign manager accused the Russian government of providing the leaked emails to WikiLeaks to help Mr. Trump.