Reporters Without Borders Targeted by Russian Hackers

According to Sekoia, the Russia-linked Star Blizzard APT targeted the French press freedom organisation Reporters Without Borders (RSF) earlier this year, with the March campaign delivered via phishing emails aimed at one of RSF’s core members. The attackers used a ProtonMail address and spoofed a trusted contact, asking the recipient to review an attached document, but intentionally did not attach it and waited for a reply.

A second email then linked to a compromised website that redirected to a PDF hosted on ProtonDrive, which could not be retrieved because Proton had blocked the operator’s account. The phishing effort included messages in French and English and employed peace negotiation themes to lure the victim into clicking a malicious link.

Sekoia notes that Star Blizzard’s phishing kit targets ProtonMail accounts and can relay two-factor authentication, with more complex code injecting into the sign-in page via an AiTM technique to collect credentials. Star Blizzard, also tracked as UNC4057, Callisto, ColdRiver and Seaborgium, has been active since at least 2019, and in 2023 the US government publicly linked the group to Russia’s FSB.