Security analysts have uncovered a sophisticated spear-phishing campaign targeting French non-governmental organization Reporters Without Borders (RSF) and another undisclosed entity in May and June 2025, attributed to the Russian-nexus intrusion set Calisto.
This group, also known as ColdRiver or Star Blizzard, has been designated by the United States, United Kingdom, New Zealand, and Australia as operating under the Russian Federal Security Service (FSB), specifically the Center 18 for Information Security (TsIB), and the military unit 64829.
The campaign address the ClickFix attack technique to compromise credentials and execute malicious code, representing a continued evolution of Calisto’s tactics despite extensive public documentation of their operations.
Calisto has maintained active cyber espionage operations since at least April 2017, targeting Western nations, Eastern European countries, and organizations supporting Ukraine.
The intrusion set’s victimology includes NATO entities, Ukraine-based defense contractors, NGOs, think tanks, former intelligence officials, Russian affairs experts, and Russian citizens abroad.
The recent targeting of RSF, designated an “undesirable organization” by Russian authorities in August 2025, aligns with Calisto’s strategic objectives of monitoring and disrupting entities that assist Russian journalists fleeing the country.
The Threat Detection and Response (TDR) team has tracked Calisto’s tactics, techniques, and procedures (TTPs) since 2022, previously documenting their intelligence collection activities aimed at disrupting Kyiv’s military supply chain logistics.
ClickFix Technique and Deception Tactics
The spear-phishing campaign leverages social engineering through impersonation of trusted contacts, a hallmark of Calisto operations.
In the RSF incident, the initial phishing email originated from a ProtonMail address designed to mimic a known contact, requesting document review but deliberately omitting the attachment.
This technique prompts victims to respond, requesting the missing file, thereby establishing a credible dialogue before delivering the malicious payload.
The follow-up email contained a link to a compromised website serving as a redirector to a ProtonDrive URL hosting the malicious content.
A second targeting attempt utilized a different deception method where the attacker attached a file masquerading as a PDF but was actually a ZIP archive with a .pdf extension.
This non-functional decoy deepens the victim’s engagement, leading them to request a “corrected” version that delivers the actual malicious payload.
The final PDF presented to victims displays an encryption icon with instructions to click a link for ProtonDrive access, redirecting through compromised websites to the phishing kit.
Phishing Kit Analysis and Infrastructure
The analyzed phishing kit, hosted at account. simpleasip[.]org, represents a custom-built framework rather than a known toolkit like Evilginx.
The kit employs an Adversary-in-the-Middle (AiTM) technique, injecting malicious JavaScript into a cloned ProtonMail interface.
Upon page load, the username field is pre-populated with the victim’s email address while forced-focus JavaScript runs every 250 milliseconds, immediately returning the cursor to the password field if users attempt to click elsewhere.
The injected code defines an ownershipSubmitCallback method that intercepts form submission and communicates with an attacker-controlled API at scorelikelygateway.simleasip[.]org.
This intermediary infrastructure processes credentials and handles authentication flows, including CAPTCHA and two-factor authentication presentations.
Analysis revealed the Webpack bundle (public-index.7162a3fd.js) differs from the legitimate ProtonMail version, containing patches that invoke the malicious callback method.
Despite the phishing interface returning 404 errors after authentication, the login attempt successfully accessed the decoy account from IP address 196.44.117[.]196, associated with the Big Mama Proxy service.
Infrastructure analysis identified domain registration patterns through Regway during Q1 and Q2 2025, subsequently transitioning to Namecheap’s free authoritative servers (freedns*.registrar-servers.com) or standard servers (dns1.registrar-servers.com).
This evolution in registration behavior provides medium-confidence attribution indicators for tracking Calisto infrastructure, likely compromised through credential leaks from information-stealing malware.
Calisto’s persistent spear-phishing campaigns demonstrate continued refinement of credential harvesting and code execution techniques despite extensive public reporting.
The targeting of Ukraine-supporting NGOs and individuals with intelligence on the conflict underscores the threat actor’s alignment with Russian strategic interests.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
.){kind=link}