Islamist State supporters are no longer the prime suspects in the investigation launched by the French government following the hacking of Gallic-language TV station TV5 Monde in April, according to French mag L’Express.

The investigation, which is spearheaded by French authorities with the help of U.S. cybersecurity company FireEye, is now indicating that Russian hackers linked to the Kremlin could be behind the attack, per a judicial source quoted by L’Express.

The hacking caused TV5 Monde to lose control of its TV station (comprising 11 channels), website and social-media accounts for a few hours on April 8.

A group belonging to the Islamic State called CyberCaliphate was initially linked to the attack. Reports had said the hackers, who posted images of a masked man on some pages and warnings on TV5’s Facebook account, orchestrated the cyber-assault to retrieve IDs of French military personnel believed to be involved in anti-IS operations along with the U.S. military.

But FireEye stated that the attack could have come from a hacking group linked to the Russian executive branch.

“We suspect that this activity aligns with Russia’s institutionalized systematic ‘trolling’ — devoting substantive resources to fulltime staff who plant comments and content online that is often disruptive, and always favorable to President Putin” of Russia, said FireEye in an email.