Other recent high-profile political leaks, including those during the U.S. presidential election, have often been dumped by WikiLeaks, which has a sizeable online following and international recognition.
"There is a noticeable lack of a persona taking credit for this," said John Hultquist, a cyber researcher at FireEye, adding that such an absence made attribution more difficult.
The U.S. cyber intelligence firm Flashpoint told Reuters late Friday that an initial review of the Macron leaks indicated that APT 28, a group tied to the GRU, the Russian military intelligence unit, may be behind the leak, though evidence was not yet conclusive. Among other indicators, the firm said metadata contained in one of the leaked files showed it had been modified by someone who works in the technology industry in Moscow.
But other cyber researchers said that analysis was premature, and western security officials contacted by Reuters were cautious about assigning any attribution. The Kremlin has repeatedly denied accusations it has attempted to use cyber attacks to meddle in either the French or U.S. elections.
The Macron leaks prompted swift alarm in the United States, where many believed Russian President Vladimir Putin was again trying to put his thumb on the scales of a Western election.
U.S. intelligence agencies concluded that Putin ordered the hacking of Democratic emails during the U.S. election to benefit Republican Trump, who has been at times dismissive of those findings and resurfaced his claim earlier this week that China could have been responsible.
U.S. Senator Mark Warner, the top Democrat on the Senate Intelligence Committee, said in a statement to Reuters that the Macron leak demonstrates the urgency of his panel's investigation into Russia's alleged interference in last year's U.S. election.
Noting the Macron dump may contain fake documents mixed in with authentic material, as some analysts have suggested, Representative Adam Schiff, the top Democrat on the House Intelligence Committee, said in a statement that the leak may represent "yet another dangerous escalation of cyber interference in a Western nation's democracy."