Russian Calisto APT Targets Reporters Without Borders with Custom AiTM Phishing and “Missing File” Lure

The article reports that Russian Calisto APT targeted the French NGO Reporters Without Borders (RSF) with a custom AiTM phishing kit and a “Missing File” lure, in campaigns observed earlier this year in May and June 2025.

It notes that the operation, attributed to the Calisto group (also known as ColdRiver or Star Blizzard), is linked to the Russian Federal Security Service (FSB), specifically Center 18 for Information Security (TsIB), military unit 64829, with the objective of intelligence collection against entities supporting Ukraine.

The attackers used a homemade AiTM phishing kit to intercept credentials and real-time 2FA codes, alongside cursor-hijacking JavaScript and the impersonation of trusted contacts via ProtonMail addresses to build credibility. The infrastructure reportedly routed traffic through residential proxies via the Big Mama Proxy service, and analysts observed the technique of forcing the victim to request the missing file before delivering the malicious payload.

The researchers describe the campaign as highly targeted and caution that NGOs involved in Ukraine or individuals with intelligence on the conflict could be among potential targets, according to Sekoia[.]io and the TDR team.