Calisto Targets Reporters Without Borders in Phishing Campaign

Calisto (aka ColdRiver/Star Blizzard), a Russia-nexus FSB-linked intrusion set, conducted targeted spear-phishing campaigns in May–June 2025 against NGOs (including Reporters Without Borders), think tanks, and military-related entities supporting Ukraine. The report details social-engineered ProtonMail impersonation lures (missing or broken PDF decoys and ClickFix follow-ups), a homemade Adversary-in-the-Middle (AiTM) phishing kit that intercepts credentials and 2FA, redirector PHP scripts on compromised websites, associated infrastructure and domain indicators, and assesses ongoing targeting risk to organizations and individuals involved with Ukraine.