French NGO Reporters Without Borders Targeted by Star Blizzard
ID: baef2fa7-d093-59da-98c6-7211d1d09de2
STIX ID: report--baef2fa7-d093-59da-98c6-7211d1d09de2
Feed Name: Infosecurity Magazine (News)
A Russia-linked APT known as Star Blizzard (aka Calisto/ColdRiver) conducted a new wave of spear-phishing in May–June 2025 against Western entities and NGOs (including Reporters Without Borders). Operators used impersonation, redirected links hosted on compromised websites to ProtonDrive/ProtonMail-themed AiTM pages that relay 2FA, custom JavaScript to force password-field focus, and API endpoints for CAPTCHA/2FA handling; infrastructure analysis links domains and Namecheap/Regway registrations to the cluster.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.