CALISTO Doxxing: the FSB-linked Andrey Korinets

SEKOIA.IO documents technical links between named individual Andrey Korinets and a cluster of phishing infrastructure used by the CALISTO/Star Blizzard intrusion set (attributed to the Russian FSB), citing WHOIS records, self-signed SSL certificates, domains and IP pivots that connected multiple email addresses to phishing domains active from at least 2015–2020 and used against Ukrainian and UK targets including the UK Parliament and Cambridge University.